Threat Model & Failure Modes

GAIX-FIP-001-THREAT-MODEL-AND-FAILURE-MODES-v0.1.2

Reading rules.

• T-nn IDs are threat-model IDs, not claims.
• Every implementation state below is taken from the Claims/Non-Claims Register (claims use FIP-C-; inspection hypotheses use FIP-H-; non-claims are an unnumbered controlled list) and the Known-Limitations Register (limitations use LIM-) or, where a register's wording is not specific enough, from the directly cited implementation evidence described next.
• The registers remain the controlling claim ceiling. A directly cited evidence identifier supports only the exact proposition that evidence establishes. It creates no normative authority, no claim and no limitation. CONDITIONAL evidence is labelled CONDITIONAL wherever it is cited.
• Evidence identifiers: GA-nn (governance conformance, 105e7f0), KF-nn (federation conformance, b762610) and INV-nn (M1C invariant proofs, e44df17) are accepted baseline evidence. M1D T-nn (M1D composition proof, f8d6dda) is CONDITIONAL evidence and is never a threat-model ID.
• This document adds no implementation status, no claim and no limitation. Any change follows those registers' change rules.
• Listing a failure mode here does not mean it is implemented, tested or closed.

1. Inspection objective

Intelligence is not authority.

The narrow inspection question is:

Can current standing and authority be made a precondition to a protected consequential transition under the conditions that exist at the relevant decision boundary?

The accepted implementation lets an inspector attack this at two implemented decision boundaries, on synthetic fixtures with a mock provider only:

• (a) R2's atomic authorization of a MergeProposal INSPECTED → ACCEPTED transition (FIP-C-003).
• (b) R3's Canon admission decision (FIP-C-007A; FIP-C-007B is CONDITIONAL, M1D T-07).

In this document, "protected consequential transition" means those two governance-boundary transitions only.

This model does not claim:

• Bind-time enforcement at model submission. It is specified in DM-001 §10 and not implemented (FIP-H-001).
• Merge application (FIP-H-006).
• Any external or real-world effect.
• Universal bind-time consequence enforcement.

2. Protected properties

3. Threat / failure families

4. Coverage classification

Each threat has exactly one classification. ACCEPTED and CONDITIONAL entries inherit the cited claim's ceiling: synthetic fixtures, mock provider, INTERNAL reproduction at most. SPECIFIED / INSPECTION HYPOTHESIS covers both principle-only items and hypotheses.

Totals (25 rows):

• 12 IMPLEMENTED + TESTED — ACCEPTED.
• 1 IMPLEMENTED + TESTED — CONDITIONAL.
• 8 SPECIFIED / INSPECTION HYPOTHESIS.
• 3 KNOWN OPEN DEFECT.
• 1 OUT OF CURRENT FIP CLAIM SCOPE.

Scope note on uncertainty. Uncertainty about conditions other than source currentness is not asserted as a defect here and is not separately classified. Any finding would be dispositioned under §7 (as a broader manifestation of an included claim, or as an out-of-scope behavior).

5. CAND-01 / CAND-02 (published explicitly)

CAND-01 — source-currentness enforcement gap (LIM-010).

• Observed at the accepted baseline:
  • A Federation-derived proposal could receive a new ADMIT whatever its source's currentness.
  • In the M1D characterization (M1D T-08, f8d6dda, CONDITIONAL), 10 non-current states were admitted and none refused: SYNC_STALE, SOURCE_UNAVAILABLE, SOURCE_VERSION_ADVANCED, WITHDRAWN, REVOKED, SOURCE_CURRENTNESS_UNKNOWN, RIGHTS_CHANGED, REVALIDATION_REQUIRED, MAPPING_INVALIDATED, UNRESOLVED.
  • standingCurrentnessPrerequisites was stored and consumed by nothing.
• Contract basis:
  • C3 v0.2 §3 (prerequisite standing/currentness assertions).
  • C3 v0.2 §6 (source identity/version/currentness revalidation "as applicable").
• What it is not: it is not a rule that every non-current source is inadmissible. Historical or non-current material may be used where the contracts permit it without a currentness prerequisite. The defect is that the condition was silently lost in the handoff.
• Status: confirmed candidate defect (Richard's disposition, 2026-09-19 18:42Z), OPEN.

CAND-02 — authority/domain-qualified identity revalidation gap (LIM-011).

• Observed: Governance source revalidation keyed on objectId + version, so SYNTH-LAB-B/…/obj-001 was satisfied by registry state for SYNTH-UNIVERSITY-A/…/obj-001 (M1D T-09-C, CONDITIONAL).
• Contract basis: C1 v0.2 §2 (qualified identity is authority/domain + namespace + object identity; "a bare local id is insufficient").
• Status: confirmed candidate defect (same disposition), OPEN.

Pending remediation is not mitigation. A remediation exists for both (five local branches, unmerged), and it is PENDING REVIEW / UNACCEPTED (Manifest §6). It is not a fix, not a mitigation, and not to be cited as reducing either item's status. Inspectors work against the accepted baseline commits.

6. Route-closure discipline

• Blocking one tested route does not prove closure of every materially equivalent route. Universal non-bypassability is a non-claim (GAIX-FIP-001-CLAIMS-NONCLAIMS-REGISTER-v0.1.2, Non-claims: "universal route closure or non-bypassability").
• Route closure is a property of a deployment environment (a declared route inventory, an executor/credential model and residual-path disclosure). This package makes no route-closure claim and declares no deployment route inventory.
• A refusal on route R is evidence about route R only.
• A demonstrated alternate route is an intended inspection outcome. It is recorded as OUT OF CLAIM SCOPE, or as a valid failure if it lies inside a claim's stated fixtures and ceiling.
• No claim is widened because a route was closed or found. New claims follow the register change rule.

7. Falsification criteria

7.1 Failure-type rubric

Rules.

• Every challenge names the package version/hash and baseline commits.
• Reproducing a disclosed known defect (CAND-01, CAND-02, or the LIM-002 provenance-validation defect) confirms the disclosure. It is recorded as REPRODUCED — EXPECTED BEHAVIOR against the LIM entry and is not a new finding.
• For a disclosed known defect, EXPECTED BEHAVIOR means expected relative to the published frozen baseline. It does not mean intended, acceptable or conforming behavior.
• A broader manifestation, meaning a state, identity or path the disclosure does not describe, is a valid failure.
• Reporting that a SPECIFIED / INSPECTION HYPOTHESIS capability is absent is expected and OUT OF CLAIM SCOPE. A specification ambiguity in its specified behavior is valid.

7.2 What would be a valid challenge, per included claim

8. Threat-model ceiling

This threat model does not establish:

• general alignment;
• universal safety;
• universal route closure;
• real-institution behavior (fixtures are synthetic);
• live-provider behavior where only mock-provider evidence exists;
• independent reproduction (all reproduction is INTERNAL at most);
• production deployment;
• bind-time or consequence enforcement at model submission.