--- reference_key: vote-record-ref title: "Formal Vote Record with dissent rationale" url: "sessions/VOTE-RECORD.md" availability: available capture_method: primary captured_at: 2026-06-23T03:31:56Z document_id: REF-vote-record-ref --- # Formal Vote Record with dissent rationale | Field | Value | |-------|-------| | **Reference key** | `vote-record-ref` | | **Availability** | AVAILABLE | | **Capture method** | `primary` | | **Source type** | local_repository | | **URL / path** | sessions/VOTE-RECORD.md | | **Captured (UTC)** | 2026-06-23T03:31:56Z | | **Content type** | text/markdown | | **HTTP status** | n/a | ## Boardroom Citation Context Formal ballots with per-dissenter rationale. ## Source Location sessions/VOTE-RECORD.md ## Captured Content --- document: VOTE-RECORD maintainer: Arthur Vance / Eleanor Vance purpose: Formal ballot record with per-dissenter rationale for all adoption votes created: 2026-06-22 last_updated: 2027-06-20 --- # Formal Vote Record Complete ballot history for MVAP adoption and maturity votes. Every **NO** and **ABSTAIN** includes expertise-based rationale per boardroom protocol. **Threshold:** Majority = 14 of 27 voting participants. --- ## MVAP v1.1 Adoption --- 2026-05-12 **Session:** `sessions/2026-12-20-mvap-v1-1-backlog-zero-day-government-risk.md` **Question:** Adopt MVAP v1.1 (Pillar 7 zero-day elevation, P6 firmware mandate, government risk register) **Result:** **PASSED --- 20/27** ### Ballot summary | Item | YES | NO | Result | |------|-----|-----|--------| | MVAP v1.1 adoption | 20 | 7 | ADOPTED | | Pillar 7 Open-Source Zero-Day | 20 | 7 | ADOPTED | | P6 elevated mandatory tier-1 | 17 | 10 | ADOPTED | | Government risk register (living) | 22 | 5 | RATIFIED | | P7-08 redundant intel (non-CISA-only) | 21 | 6 | MANDATORY | ### Dissent record (MVAP v1.1 adoption --- NO voters) | Participant | Group | Vote | Rationale | |-------------|-------|------|-----------| | Marcus Thorne | Compliance | NO | Documentation and audit burden on lean compliance teams exceeds near-term benefit without automated GRC evidence collection | | NullByte Siddharth Nair | Zero-Day | NO | SLSA Level 3 still absent --- supply-chain integrity gap unacceptable for tier-1 AI gateways handling untrusted model artifacts | | Kira Okonkwo | SSCP | NO | 24-hour KEV patch SLA not mandated; leaves operations exposed to sub-36-hour exploitation windows documented in P7 case studies | | Aether Vance | Code Hacker | NO | Full firmware attestation for all tiers is premature --- GPU/TPM supply chain not mature enough for mandatory tier-2 in v1.1 | | Hex Vance | Zero-Day | NO | P7 scope adds fuzzing assignments without guaranteed headcount --- operational teams will shelf-work without staffing model | | GridLock Dimitri Volkov | CISSP | NO | OT AI tier separation referenced but not binding --- industrial deployments need IEC 62443 hard gate before shared MVAP | | Jordan Taylor | CC | ABSTAIN | Academic rigor supports P7-05 regression but membership inference controls remain optional --- abstains until P2-08 scoped | --- ## MVAP L2 Operational Promotion --- 2026-05-08 **Session:** `sessions/2026-09-20-mvap-level-2-maturity-review.md` **Question:** Promote MVAP to L2 operational maturity (purple-team semi-annual, CI/CD gates, IR-AI-02) **Result:** **PASSED --- 18/27** ### Ballot summary | Vote | Count | |------|-------| | YES | 18 | | NO | 6 | | ABSTAIN | 3 | ### Dissent record (L2 promotion) | Participant | Group | Vote | Rationale | |-------------|-------|------|-----------| | Aether Vance | Code Hacker | NO | CI/CD gates on every PR will block research velocity --- firmware attestation should gate production only, not staging | | Hex Vance | Zero-Day | NO | Semi-annual purple-team cadence insufficient for ML dependency churn --- quarterly minimum for tier-1 | | NullByte Siddharth Nair | Zero-Day | NO | L2 still omits SLSA L3 --- promoting maturity label without supply-chain proof misleads auditors | | Kira Okonkwo | SSCP | NO | MTTC <15m target not validated on production SOAR --- staging success does not justify L2 badge | | GridLock Dimitri Volkov | CISSP | NO | OT AI workloads excluded from L2 gate definitions --- promotes false enterprise-wide coverage | | Marcus Thorne | Compliance | NO | Dual-track L1+L2 documentation fragments annual attestation packets regulators expect | | Jordan Taylor | CC | ABSTAIN | Supports evidence collection thesis but P2-08 membership inference deferred --- abstains pending v1.2 | | Synapse Chen | Code Hacker | ABSTAIN | Poisoned RAG remediation incomplete in Pass 1 --- abstains until P2-03 production validation closes | | Payload Ortiz | Red Rapid | ABSTAIN | Red team not scheduled for L2 gate bypass test --- abstains until purple-team charter signed | --- ## MVAP v1.2 Control Votes --- 2026-05-20 **Session:** `sessions/2027-06-20-mvap-v1-2-adoption.md` **Question:** Adopt MVAP v1.2 control increments (P7-09 through P7-11, P6 tier-2, P2-08, SLSA L3) **Overall ratification:** **PASSED --- 20/27** ### Per-control ballots | Control | Tally | Result | |---------|-------|--------| | P7-09 Transitive SBOM | 17/27 | CONDITIONAL --- tier-1 mandatory Q3 2027 | | P7-10 KEV 4h/24h SLA | 19/27 | ADOPTED | | P7-11 AI gateway hardening | 21/27 | ADOPTED | | P6 tier-1 + tier-2 firmware | 18/27 | ADOPTED | | P2-08 membership inference | 16/27 | DEFERRED v1.2.1 | | SLSA L3 tier-1 | 16/27 | DEFERRED v1.3 | ### Dissent record (v1.2) | Participant | Group | Vote | Control | Rationale | |-------------|-------|------|---------|-----------| | NullByte Siddharth Nair | Zero-Day | NO | SLSA L3 | Third deferral of provenance proof --- tier-1 AI gateways remain audit fiction without L3 | | Oliver Hansen | Code Hacker | NO | P7-09 | Full transitive SBOM on every npm dependency generates alert fatigue without tiering --- conditional only | | Marcus Thorne | Compliance | NO | P7-10 | 4-hour SLA evidence burden on quarterly attestation --- needs GRC automation before mandatory | | Aether Vance | Code Hacker | NO | P6 tier-2 | GPU firmware attestation vendor support incomplete --- tier-2 mandate premature for 2026 | | GridLock Dimitri Volkov | CISSP | NO | P7-11 | Gateway hardening scoped to cloud LLM proxies --- OT inference endpoints still out of scope | | Jordan Taylor | CC | NO | P2-08 | Membership inference screening deferred again --- academic bias-risk controls remain optional | | Kira Okonkwo | SSCP | YES (dissent on deferral) | SLSA L3 | Voted YES on v1.2 package but records dissent that SLSA L3 deferral to v1.3 leaves P3 gap | --- ## Government Risk Register Reaffirmation --- 2026-05-21 **Session:** `sessions/2027-06-20-quarterly-government-risk-review-q2.md` **Question:** Reaffirm government risk register v2.0 **Result:** **PASSED --- 20/27** ### Dissent record | Participant | Group | Vote | Rationale | |-------------|-------|------|-----------| | Marcus Thorne | Compliance | NO | GOV-02 Critical+ without mandatory P7-07 classified-adjacent vendor audit --- register severity not matched to control mandate | | NullByte Siddharth Nair | Zero-Day | NO | GOV-11 marked mitigated but SLSA L3 still deferred --- KEV closure does not equal supply-chain closure | | Hex Vance | Zero-Day | NO | Register treats EO 14409 clearinghouse as operational --- partial deployment not verified in enterprise context | | Kira Okonkwo | SSCP | NO | MS-ISAC degradation (GOV-04) mitigation relies on redundant feeds not yet tested in failover drill | | Aether Vance | Code Hacker | ABSTAIN | Salt Typhoon persistence confirmed but OT segment controls undefined --- abstains on enterprise-wide reaffirmation | | GridLock Dimitri Volkov | CISSP | ABSTAIN | Water sector gaps (GOV-07) acknowledged but IEC 62443 OT tier not integrated --- abstains | | Jordan Taylor | CC | ABSTAIN | NVD backlog (GOV-10) AI-discovery claims need academic replication --- abstains on severity rating | --- ## Selected Consensus Votes (Rounds 120) | Decision | Tally | Session reference | |----------|-------|-------------------| | NIST AI RMF as MVAP governance floor | 18/27 | rounds-1-20, Round synthesis | | OWASP LLM Top 10 for customer-facing apps | 20/27 | rounds-1-20 | | KMS encryption for weights/embeddings | 18/27 | rounds-1-20 | | Dual compliance model | 18/27 | rounds-1-20 | | MVAP five-pillar core (Round 19) | 14+/27 per pillar | rounds-1-20, Round 19 | Per-pillar Round 19 dissent captured in `sessions/2026-06-22-cybersecurity-ai-diligence-rounds-1-20.md` moderator synthesis sections. --- *Maintained with session transcripts. Cross-reference: `output/How-The-Research-Was-Done.md` Section 6.* --- *Archived reference article for AICSR-STUDY-2026-001 footnote corpus.*