---
document: VOTE-RECORD
maintainer: Arthur Vance / Eleanor Vance
purpose: Formal ballot record with per-dissenter rationale for all adoption votes
created: 2026-06-22
last_updated: 2027-06-20
---

# Formal Vote Record

Complete ballot history for MVAP adoption and maturity votes. Every **NO** and **ABSTAIN** includes expertise-based rationale per boardroom protocol.

**Threshold:** Majority = 14 of 27 voting participants.

---

## MVAP v1.1 Adoption — 2026-05-12

**Session:** `sessions/2026-12-20-mvap-v1-1-backlog-zero-day-government-risk.md`  
**Question:** Adopt MVAP v1.1 (Pillar 7 zero-day elevation, P6 firmware mandate, government risk register)  
**Result:** **PASSED — 20/27**

### Ballot summary

| Item | YES | NO | Result |
|------|-----|-----|--------|
| MVAP v1.1 adoption | 20 | 7 | ADOPTED |
| Pillar 7 Open-Source Zero-Day | 20 | 7 | ADOPTED |
| P6 elevated mandatory tier-1 | 17 | 10 | ADOPTED |
| Government risk register (living) | 22 | 5 | RATIFIED |
| P7-08 redundant intel (non-CISA-only) | 21 | 6 | MANDATORY |

### Dissent record (MVAP v1.1 adoption — NO voters)

| Participant | Group | Vote | Rationale |
|-------------|-------|------|-----------|
| Marcus Thorne | Compliance | NO | Documentation and audit burden on lean compliance teams exceeds near-term benefit without automated GRC evidence collection |
| NullByte Siddharth Nair | Zero-Day | NO | SLSA Level 3 still absent — supply-chain integrity gap unacceptable for tier-1 AI gateways handling untrusted model artifacts |
| Kira Okonkwo | SSCP | NO | 24-hour KEV patch SLA not mandated; leaves operations exposed to sub-36-hour exploitation windows documented in P7 case studies |
| Aether Vance | Code Hacker | NO | Full firmware attestation for all tiers is premature — GPU/TPM supply chain not mature enough for mandatory tier-2 in v1.1 |
| Hex Vance | Zero-Day | NO | P7 scope adds fuzzing assignments without guaranteed headcount — operational teams will shelf-work without staffing model |
| GridLock Dimitri Volkov | CISSP | NO | OT AI tier separation referenced but not binding — industrial deployments need IEC 62443 hard gate before shared MVAP |
| Jordan Taylor | CC | ABSTAIN | Academic rigor supports P7-05 regression but membership inference controls remain optional — abstains until P2-08 scoped |

---

## MVAP L2 Operational Promotion — 2026-05-08

**Session:** `sessions/2026-09-20-mvap-level-2-maturity-review.md`  
**Question:** Promote MVAP to L2 operational maturity (purple-team semi-annual, CI/CD gates, IR-AI-02)  
**Result:** **PASSED — 18/27**

### Ballot summary

| Vote | Count |
|------|-------|
| YES | 18 |
| NO | 6 |
| ABSTAIN | 3 |

### Dissent record (L2 promotion)

| Participant | Group | Vote | Rationale |
|-------------|-------|------|-----------|
| Aether Vance | Code Hacker | NO | CI/CD gates on every PR will block research velocity — firmware attestation should gate production only, not staging |
| Hex Vance | Zero-Day | NO | Semi-annual purple-team cadence insufficient for ML dependency churn — quarterly minimum for tier-1 |
| NullByte Siddharth Nair | Zero-Day | NO | L2 still omits SLSA L3 — promoting maturity label without supply-chain proof misleads auditors |
| Kira Okonkwo | SSCP | NO | MTTC <15m target not validated on production SOAR — staging success does not justify L2 badge |
| GridLock Dimitri Volkov | CISSP | NO | OT AI workloads excluded from L2 gate definitions — promotes false enterprise-wide coverage |
| Marcus Thorne | Compliance | NO | Dual-track L1+L2 documentation fragments annual attestation packets regulators expect |
| Jordan Taylor | CC | ABSTAIN | Supports evidence collection thesis but P2-08 membership inference deferred — abstains pending v1.2 |
| Synapse Chen | Code Hacker | ABSTAIN | Poisoned RAG remediation incomplete in Pass 1 — abstains until P2-03 production validation closes |
| Payload Ortiz | Red Rapid | ABSTAIN | Red team not scheduled for L2 gate bypass test — abstains until purple-team charter signed |

---

## MVAP v1.2 Control Votes — 2026-05-20

**Session:** `sessions/2027-06-20-mvap-v1-2-adoption.md`  
**Question:** Adopt MVAP v1.2 control increments (P7-09 through P7-11, P6 tier-2, P2-08, SLSA L3)  
**Overall ratification:** **PASSED — 20/27**

### Per-control ballots

| Control | Tally | Result |
|---------|-------|--------|
| P7-09 Transitive SBOM | 17/27 | CONDITIONAL — tier-1 mandatory Q3 2027 |
| P7-10 KEV 4h/24h SLA | 19/27 | ADOPTED |
| P7-11 AI gateway hardening | 21/27 | ADOPTED |
| P6 tier-1 + tier-2 firmware | 18/27 | ADOPTED |
| P2-08 membership inference | 16/27 | DEFERRED v1.2.1 |
| SLSA L3 tier-1 | 16/27 | DEFERRED v1.3 |

### Dissent record (v1.2)

| Participant | Group | Vote | Control | Rationale |
|-------------|-------|------|---------|-----------|
| NullByte Siddharth Nair | Zero-Day | NO | SLSA L3 | Third deferral of provenance proof — tier-1 AI gateways remain audit fiction without L3 |
| Oliver Hansen | Code Hacker | NO | P7-09 | Full transitive SBOM on every npm dependency generates alert fatigue without tiering — conditional only |
| Marcus Thorne | Compliance | NO | P7-10 | 4-hour SLA evidence burden on quarterly attestation — needs GRC automation before mandatory |
| Aether Vance | Code Hacker | NO | P6 tier-2 | GPU firmware attestation vendor support incomplete — tier-2 mandate premature for 2026 |
| GridLock Dimitri Volkov | CISSP | NO | P7-11 | Gateway hardening scoped to cloud LLM proxies — OT inference endpoints still out of scope |
| Jordan Taylor | CC | NO | P2-08 | Membership inference screening deferred again — academic bias-risk controls remain optional |
| Kira Okonkwo | SSCP | YES (dissent on deferral) | SLSA L3 | Voted YES on v1.2 package but records dissent that SLSA L3 deferral to v1.3 leaves P3 gap |

---

## Government Risk Register Reaffirmation — 2026-05-21

**Session:** `sessions/2027-06-20-quarterly-government-risk-review-q2.md`  
**Question:** Reaffirm government risk register v2.0  
**Result:** **PASSED — 20/27**

### Dissent record

| Participant | Group | Vote | Rationale |
|-------------|-------|------|-----------|
| Marcus Thorne | Compliance | NO | GOV-02 Critical+ without mandatory P7-07 classified-adjacent vendor audit — register severity not matched to control mandate |
| NullByte Siddharth Nair | Zero-Day | NO | GOV-11 marked mitigated but SLSA L3 still deferred — KEV closure does not equal supply-chain closure |
| Hex Vance | Zero-Day | NO | Register treats EO 14409 clearinghouse as operational — partial deployment not verified in enterprise context |
| Kira Okonkwo | SSCP | NO | MS-ISAC degradation (GOV-04) mitigation relies on redundant feeds not yet tested in failover drill |
| Aether Vance | Code Hacker | ABSTAIN | Salt Typhoon persistence confirmed but OT segment controls undefined — abstains on enterprise-wide reaffirmation |
| GridLock Dimitri Volkov | CISSP | ABSTAIN | Water sector gaps (GOV-07) acknowledged but IEC 62443 OT tier not integrated — abstains |
| Jordan Taylor | CC | ABSTAIN | NVD backlog (GOV-10) AI-discovery claims need academic replication — abstains on severity rating |

---

## Selected Consensus Votes (Rounds 1–20)

| Decision | Tally | Session reference |
|----------|-------|-------------------|
| NIST AI RMF as MVAP governance floor | 18/27 | rounds-1-20, Round synthesis |
| OWASP LLM Top 10 for customer-facing apps | 20/27 | rounds-1-20 |
| KMS encryption for weights/embeddings | 18/27 | rounds-1-20 |
| Dual compliance model | 18/27 | rounds-1-20 |
| MVAP five-pillar core (Round 19) | 14+/27 per pillar | rounds-1-20, Round 19 |

Per-pillar Round 19 dissent captured in `sessions/2026-06-22-cybersecurity-ai-diligence-rounds-1-20.md` moderator synthesis sections.

---

*Maintained with session transcripts. Cross-reference: `output/How-The-Research-Was-Done.md` Section 6.*