# ADR-0002: Canonical dispositions and transitive mission boundaries

- **Status:** Accepted for Wave A2
- **Date:** 2026-08-25
- **Scope:** `v3-migration/completeness` only

## Context

The umbrella ledger preserved broad inventory closure, but it assigned the
same `blocked` default to every actionable record. That was conservative but
not truthful for the 36 V2 contract identities: some have evidenced V3 safety
ports, some are redesigned, some are deliberately retired, and others are
deferred. It also checked unsafe signals only within a single row, which could
miss influence relayed through an SDK, metadata document, wrapper, cross-chain
message, or governance job.

V2 ABI and runtime evidence is immutable. Source implementation status must
also remain independent from deployment authorization.

## Decision

1. Make `v2-contract-dispositions.json` the canonical one-to-one disposition
   authority for all 36 identities in `legacy/v2/manifest.json`.
2. Separate six concepts on every identity row:
   implementation obligation, V3 support status, evidence status, deployment
   status, mission-boundary rationale, and exact target modules.
3. Permit only `ported`, `redesigned`, `retired`, or `deferred` identity
   support states. These are not deployment states.
4. Require each port/redesign target to exist in the supported V3 module
   manifest. Retired/deferred records must claim no target module.
5. Keep every current deployment state `not-deployed-not-authorized`.
6. Treat belief, flourishing, reputation, trust-score, and
   behavioral-routing capabilities as unsafe inputs to protected decisions.
   Reputation/validation source modules may remain available as informational
   evidence only, with an empty protected-decision allowlist.
7. Model decision influence as a directed graph. CI traverses only edges
   explicitly marked as carrying decision influence and rejects any transitive
   unsafe-to-protected path.
8. Require graph coverage for contracts, SDKs, API metadata, wrappers,
   cross-chain messages, and governance automation, and for custody, access,
   eligibility, pricing, slashing, settlement, disputes, and routing.

## Consequences

- A source file or test can support a `ported`/`redesigned` claim without
  implying that an address exists or deployment is authorized.
- Immutable V2 ABI hashes and file paths are checked against the frozen V2
  manifest; the new records reference but do not rewrite that evidence.
- Unsafe metadata cannot become safe merely by passing through another layer.
- New inventory still fails closed as unresolved. Only canonical decisions
  escape the default, and drift between the ledger and disposition manifest is
  rejected.
- Cross-chain execution remains deferred; graph coverage is a policy check,
  not a claim that a V3 bridge is implemented.

## Non-decision

This ADR does not authorize deployment, RPC access, wallet use, V2 mutation,
or any change to the concurrently edited Base implementation files.
