Deployed global non-bypassability and veto coverage of the Havenlon Arbiter

Establish whether the deployed Havenlon architecture is globally non-bypassable at the Arbiter boundary and whether the Arbiter’s boundary-bound veto covers every feasible realization witness for the protected signing transition.

Background

The paper analyzes Havenlon’s Arbiter as a candidate and documented claimed-final boundary for a protected signing action. In the source-bounded protocol model, ordinary signing witnesses traverse the Arbiter, but certificate replacement changes trusted-input semantics and yields an alternative source-enumerated witness. The authors therefore distinguish the documented architectural claim from a demonstrated deployment-wide property.

The unresolved issue concerns the deployed system rather than only the bounded protocol model: hidden interfaces, physical access, lifecycle powers, recovery mechanisms, and other omitted witnesses could bypass the Arbiter or defeat its veto. Establishing the property would require a deployment-complete witness inventory and evidence that every feasible witness traverses the boundary and is covered by the boundary-bound veto.