The rules by which I decide what to show you.

Raw actor-id boundary

Closes: a raw sov:/human: id — whose slug IS the human's callsign — reaching a machine surface.

redactActorFields / publicActorTag (S211 · S221)

Guards: /api/state · /api/orders · /api/quarantine · every actor-keyed projector

Obelisk denial-receipt boundary

Closes: a crossing actor's raw sov:/human: id on the machine ledger an agent polls to AUDIT the organism (the 9th carrier).

publicDenialReceiptView (S221 · D-S236.1)

Guards: /api/transparency · /api/quarantine · /verify/:id · /api/state denial receipts

Held-spam signal boundary

Closes: a gate-rejected or quarantined spam signal's free-typed name + body reaching the Record.

signalBoundary.isHeldSignal (S214)

Guards: /api/state · /api/hive/lessons · /imprint/feed.json · /collaborate · /ledger · the feeds

Contribution feed boundary

Closes: a signed-in Sovereign's raw id + held-spam contributions on the polled machine feed.

publicContributionFeed (S235 · D-S235.1)

Guards: /imprint/feed.json · /collaborate/feed.json

Whisper archive boundary

Closes: a Steward-eyes-only whisper event crossing a public timeline.

isPublicArchiveEvent (S203)

Guards: /api/state archiveEvents · the chronicle + pulse feeds

Whisper receipt boundary

Closes: a whisper signal's Steward note copied onto its public receipt.

publicReceiptView / isWhisperLinkedReceipt (S204)

Guards: /receipt/:id · its Atom feed · /passport · /api/state receipts

Confluence slug boundary

Closes: two conveners' crossing callsigns (bare slugRoots) deanonymized on a confluence surface.

redactActorFields roots/confluence_key strip (S225 · S229)

Guards: /api/state imprints + archive events · the due feed

Shared-cache audience boundary

Closes: one Sovereign's personalized page or proof card being stored by a SHARED cache under an actor-free URL and replayed to every later caller — the 12th carrier, and the first in the AUDIENCE dimension rather than the contents one.

cacheBoundaryFor / bindCacheAudience (S239 · D-S239.1)

Guards: every response at the worker edge — /passport/card.svg · /invite/card.svg · /badge.svg · /boundaries · /recovery · /abstentions · /constitution · /discrimination · /metabolism

Credential hand-off boundary

Closes: a shared cache storing the response that MINTS a Sovereign Key and replaying that credential to the next caller. This one is a CLASS bound on a LATENT instance and says so: all six sites are 303s, which RFC 9111 omits from the heuristically-cacheable statuses, so nothing was being stored. That was a status-code accident rather than a boundary — the first cookie-setting 200 would have put a Sovereign Key into a shared cache.

cacheBoundaryFor setsCookie clause / bindCacheAudience (S240 · D-S240.1)

Guards: every response that hands the caller a cookie — the /initiate crossing · /reconcile key recovery · the Obelisk SSO callback · the witness receipt · POST /theme · POST /signout

Connection boundary

Closes: the first request of a visit — a typed address, an http:// link, a QR code — leaving the browser in cleartext where an on-path attacker can answer the redirect themselves and proxy the site. Every other boundary here governs what a response CONTAINS or who may RECEIVE it; this one governs the pipe they all travel through, and it was the only one never declared.

transportSecurityFor / bindCacheAudience (S240 · D-S240.3)

Guards: every HTTPS response the worker returns

Request-provenance boundary

Closes: a forged cross-site request MAKING the organism mint a Sovereign Key into a victim's browser — login-CSRF / session fixation. The three sibling rows above reason about the RESPONSE (who receives it, what it hands back, the pipe it travels); this is the one that reads the REQUEST: did this exchange originate here? A body leak spends an identifier and a Set-Cookie leak spends a credential — but a forged request spends the WHOLE session, binding the victim's browser to the attacker's identity so every act they take is recorded as the attacker's.

requireSameOrigin / crossOriginRequest (S241 · D-S241.2)

Guards: every credential-minting POST door — /return · /initiate · /reconcile · POST /theme · POST /signout

Navigation-capability boundary

Closes: a path-shaped value whose backslash becomes a browser authority, turning a local redirect into an off-origin navigation capability.

localNavigationTarget (S248 · D-S248.1)

Guards: every form- or query-derived post-action return — callsign visibility · seconding · Court confirmation · Obelisk login · imprint report · theme · signout

Failure-projection boundary

Closes: a payment provider's or a runtime's own words travelling out under the organism's name. Every row above governs a SUCCESS projection — a value VEILOS wrote and then chose to publish. A failure answers with text VEILOS did NOT write, so no projector had ever been applied to it: Stripe's "No such customer: cus_…" reached an unauthenticated visitor as the receipt code, because normalizeMutationReason SHAPED the value without ever BOUNDING it.

publicFailureReason (S246 · D-S246.1)

Guards: every public failure response — the /cross · /endow · /oracle · /evolutions · /standing checkout doors, /api/soul, /api/treasury's last_attempt, the MCP agent surface, the outbound reach and mail lanes, and this census's own probe catch

Identity-addressing boundary (capability monotonicity)

Closes: the public tag reversing into the raw sov: id. Every row above asks what a projection may CONTAIN; this one asks what it may HAND BACK relative to what it was GIVEN. S228 made travelling proof cards address a Sovereign by tag precisely so the callsign-bearing id would stop riding along — and the page those cards point at published that id anyway, so one weak address bought the strongest one and the anonymity promise held in the H1 while breaking one element below it.

mayPublishRawActorId / renderPassportPage `via` (S247 · D-S247.1)

Guards: /passport and every future person-addressed page reached by the public 4-hex tag

Anonymity-set cardinality boundary

Closes: a Sovereign being named by ARITHMETIC rather than by a field. Every row above governs what a projection may SAY about a person; this one governs how many people a redaction has to hide among. `commonsGraph` labelled every un-opted-in convener "a Sovereign" and published the population total in the same object — and a reader can count the NAMED ends by eye but never the anonymous ones, so one subtraction gives k. At k = 1 the placeholder is a unique designator: every "a Sovereign" on the page is provably the same individual and their whole convergence neighbourhood links into one profile, with the projection itself supplying the proof of uniqueness.

anonymitySet / publicPopulationCounts (S249 · D-S249.1)

Guards: every projection that renders an anonymizing placeholder beside a population count — /commons, the /mcp commonsGraph tool, /api/presence