the off-box signer (_COORD_SIGN_v1_, lang/cue/sign.cue): the guards a sign request passes before KMS is asked. Admission guards bound a flood before any rule runs; rule guards are a purpose's fence, checked from the signer's own state and the chain, never from what the box says; mode guards keep a shadowed or killed purpose from signing. The runtime (taifoon-agents coord-sign/) implements each by this name and nothing else.
release 4: a leaf · the inclusion proof · head 0x70ca62614037642b…