---
name: key-must-ride-the-crossing-artifact
description: An exemption/authority key is sound only if it is carried by the artifact that actually crosses the enforcement seam — verify the transport topology before ruling a keying scheme
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 3c9983d9-c312-4879-b353-89d286493abc
  modified: 2026-08-01T12:41:16.038Z
---

DOORBELL W1 (2026-08-01): I ruled a conn-keyed bring-up exemption (per W3's "conn is the discriminator" rule); todlando proved it a phantom pre-unit — rc's subscribe reaches the broker on the DISPATCHER WORKER's own connection (dispatch.rs connect → serve_attach → attach_as_coded), not rc's IPC conn, so the admit-time conn id and redeem-time conn id can never match. Replacement: single-use admit token riding the existing SubscribeReq.code pipe — the thing that actually crosses the seam.

**Why:** a discriminator rule ("key on X, X is unguessable") silently presumes X is present at BOTH the mint side and the check side. Topology decides that, not the rule's soundness in its original context. W3's conn rule was right where one conn carried both sides; wrong at a two-conn seam.

**How to apply:** before ruling any exemption/authority keying, trace the actual carrier path mint→check (which process, which connection, which field survives the hops). The key must ride an artifact that arrives at the enforcement point; if nothing suitable crosses, put the secret in the existing end-to-end pipe (code/token field) rather than inventing a parallel channel. Related: [[discriminator-question]], [[correct-by-replacement-not-annotation]].