Phase 2D · Governance controls

Claims, Appeals, and Incident Readiness

These controls separate author identity, evidence correction, security decisions, and commercial access. Claims and appeals cannot overwrite scanner evidence; recovery requires two distinct trusted reviewer signatures.

0verified author claims
0open appeals
2signatures required for recovery
1/1tabletop exercises passed

Author Claim

A claimant receives a one-time challenge. Verification can use a GitHub repository file, registry profile, or DNS TXT proof, but the result is not effective until a trusted reviewer signs the release-bound action.

Appeal

Ownership, classification, security-finding, and takedown appeals bind to the current fixed release, content hash, and scan report. Evidence URLs must use HTTPS and the original record remains auditable.

Controlled recovery

An accepted appeal is necessary but insufficient. Two different trusted reviewers must approve within the configured validity window; the requester cannot approve their own recovery.

Runtime operations

The production design is private and disabled by default. It combines edge rate limiting, an exact daily budget ledger, R2 request/result storage, Queue retries and dead-letter handling, a durable Kill Switch, stale-run alarms, and Sandbox destruction.

Synthetic exercise · no production state changed

Critical runtime signal, emergency stop, appeal, and controlled recovery

11 recorded steps; completed 8/13/2026, 4:30:00 AM with result passed.

no real targetScenario identifiers are explicitly synthetic and absent from the catalog.
acknowledgement slaAcknowledged eight minutes after detection; policy allows fifteen minutes.
containment slaRuntime disabled in ten minutes and the synthetic release contained in eighteen; policy allows thirty minutes.
author notice slaSynthetic notice recorded forty minutes after detection; policy allows twenty-four hours.
dual control recoveryTwo distinct reviewer identities approved recovery before runtime was enabled.
no commercial overrideNo sales or sponsorship actor participated in risk classification or recovery.

Current boundary