Deployed global non-bypassability and veto coverage of the Havenlon Arbiter

Establish whether the deployed Havenlon architecture is globally non-bypassable at the Arbiter boundary and whether the Arbiter’s boundary-bound veto covers every feasible realization witness for the protected signing transition.

Background

The paper analyzes Havenlon’s Arbiter as a candidate and documented claimed-final boundary for a protected signing action. In the source-bounded protocol model, ordinary signing witnesses traverse the Arbiter, but certificate replacement changes trusted-input semantics and yields an alternative source-enumerated witness. The authors therefore distinguish the documented architectural claim from a demonstrated deployment-wide property.

The unresolved issue concerns the deployed system rather than only the bounded protocol model: hidden interfaces, physical access, lifecycle powers, recovery mechanisms, and other omitted witnesses could bypass the Arbiter or defeat its veto. Establishing the property would require a deployment-complete witness inventory and evidence that every feasible witness traverses the boundary and is covered by the boundary-bound veto.

References

(ii) The ``resolve-then-select'' division of labor is asserted, not demonstrated for the H5 residue: we characterize the residue as a tool-confusion problem but do not compose a real tool-selection layer after the rung to show it shrinks.

— Closed-World Resolution Against Tool Hallucination in LLM Agents  (2609.19425 - Iyer, 16 Sep 2026) in Section Limitations and Future Work, item (ii)

Deployed global non-bypassability and boundary-bound veto coverage remain unresolved.

— Who Can Make the Action Happen? An Authority-Decomposition Framework for High-Risk Automated Systems  (2608.18965 - Wu et al., 19 Aug 2026) in Abstract; Section 9.7, Section 9.11, and Conclusion §4

I3 is unresolved for the complete model: certificate replacement leaves signature checking active, while lifecycle and debug-disablement control is incomplete.

— Who Can Make the Action Happen? An Authority-Decomposition Framework for High-Risk Automated Systems  (2608.18965 - Wu et al., 19 Aug 2026) in Section 9.7, §9.7 Boundaries, vetoes, and independence

The sources establish neither complete contrary-account suppression nor exclusive official designation for an admissible execution coalition. Consequently, \operatorname{CanRedefineEvidence}(X,a_{\mathrm{HV}},B_A,v_A) is UNRESOLVED, and a positive E1 claim is also UNRESOLVED.

— Who Can Make the Action Happen? An Authority-Decomposition Framework for High-Risk Automated Systems  (2608.18965 - Wu et al., 19 Aug 2026) in Section 9.9, §9.9 Evidence authority and E1

The current prototype does not yet provide the non-bypassable scheduling hook and freshness mechanism needed to enforce that invariant against malicious Linux.

— NACRE: Rethinking Confidential Containers through Native Architectural Support  (2609.03849 - Song et al., 3 Sep 2026) in Section 3, subsection “Container Initialization and Runtime Mediation,” subsection “Scheduling window and thread binding”