# Threat model

## Closed by the kit

- A public request cannot ingest a receipt, issue a checkpoint, or mutate state.
- The key is generated by the operator, stored separately with mode `0600`, and
  excluded from the exact candidate wire.
- Restarted operation reloads and authenticates checkpoint history before
  appending another head.
- The candidate binds exact receipt, intake, policy, disclosure, checkpoint,
  inclusion, consistency, and source-closure bytes under the operator key.
- Inclusion is checked against the exact signed checkpoint and the receipt's
  recomputed leaf. Adjacent consistency and predecessor binding must both pass.
- The source-only files remain excluded from Bulla's wheel, sdist, stable
  exports, and CLI.

## Remains outside cryptography

- Whether the named organization exists and controls the submitted key,
  endpoint, infrastructure, policies, and operation.
- Whether that control domain is separate from Glyph.
- Whether the endpoint was stable outside the bounded qualification probes.
- Whether stated retention and privacy policies were or will remain satisfied.
- Whether a witness statement establishes occurrence or truth.
- Whether capital, a forum, recourse authority, or an execution rail exists.

An operator signature authenticates the package under its did:key. It does not
prove that GitHub, Docker, Glyph, a workflow, or any named organization caused
the operation. Repository review is the later institutional qualification act.

## Deliberately unsupported

Public intake, remote checkpoint mutation, automatic qualification,
self-declared independence, transformed or manually transcribed secrets in
operator disclosures, private customer cargo, stake-weighted truth,
payments, ranking, bonding, slashing, adjudication, and settlement.
