C2-L did not weaken the financial-effect protocol. It stopped using remote location as a proxy for two different assurances.
The old rule sounded safer
The original instinct was simple:
Real money should only move through an independently administered remote executor.
That rule has obvious appeal. If the Agent workstation cannot read the trading credential, replace the signer, rewrite the executor, or alter its policy, a compromised Agent has fewer ways to seize authority.
But the rule also smuggles in a stronger claim:
Without remote administration, the effect itself cannot be correct.
C2-L was designed to attack that second claim.
One word—safety—was hiding two axes
The experiment split the question into two independent assurances.
Axis 1: effect correctness
Can the system preserve:
- the exact economic intent and world binding;
- one durable dispatch permission;
- no blind retry after ambiguity;
- raw evidence and exact replay;
- reconciliation before another consequence;
- explicit separation between preparation and submission?
Axis 2: credential and administrator isolation
Can the Agent-admin principal read or replace:
- venue credentials;
- private signer authority;
- TrustPolicy;
- executor release bytes;
- service configuration or ledger administration?
These questions are related in a deployment threat model. They are not the same invariant.
The root probe destroyed the isolation claim
The current Runtime trusted_local profile executes as root.
C2-L performed a metadata-only authority probe and established that this principal could read or write the root-owned executor credential files, TrustPolicy, and systemd unit.
Therefore the current single-machine profile cannot honestly claim protection from a malicious or compromised root Agent.
Systemd hardening, read-only release bytes, DynamicUser, and LoadCredential can reduce accidental coupling. They cannot create an adversarial boundary against the same root authority.
That part of the old safety story was falsified.
Then the effect protocol refused to fail with it
The next question was whether losing hostile-root isolation also destroyed the effect-correctness properties.
On the disabled C2/v3 staging surface, the retained protocol still enforced:
- Package v3 / Grant v2 / EffectAdmission v2 / commit@5 version closure;
- Decision, Proposal, Request, and world-gate identity before effect admission;
- purpose-separated signer roles;
- immutable versioned executor release with no historical executable fallback;
- a loopback-only narrow HTTP surface;
- exactly one durable dispatch permission;
- exact replay before mutable venue reads;
- no second POST after a consumed dispatch claim;
- raw evidence retention and reconciliation-first ambiguous outcomes;
- a disabled-first kill boundary.
The focused evidence recorded:
The correct conclusion became narrower:
Remote location is one way to buy stronger credential/admin independence. It is not itself a law of effect correctness.
A two-axis picture is more useful than safe/unsafe
This is why “remote” and “safe” are poor synonyms.
The experiment also found two real blockers
C2-L did not use the narrower architecture claim as permission to activate trading.
The exact executor credential installed in the disabled staging profile did not match the separately valid canonical Read+Trade/no-Withdraw profile. A read-only account-config check using the executor credential returned 401 Invalid OK-ACCESS-KEY.
The experiment therefore refused to infer executor fitness from a different credential merely because that other credential belonged to the same account.
Local private signer authority was also not provisioned or verified.
These were not cosmetic checklist items. They were current deployment facts, and they remained blockers.
Preparation is not submission
The current policy separates:
mechanically qualified preparation
≠ authorization to submit a live effectThe disabled staging executor used an unreachable API base, exposed no raw authenticated write route, and returned executor-disabled before venue action. No financial write occurred during C2-L.
Even if localEffectCorrectnessQualified=true, a live canary still requires a separate transition proving exact credential permissions, usable signers, real venue reachability, and live reconciliation.
Why this matters beyond Finance
Engineering systems often collapse several assurances into one prestigious mechanism:
- containerized → isolated;
- remote → independent;
- encrypted → authorized;
- transactional → correct;
- redundant → reliable.
Sometimes the mechanism contributes to the assurance. The error is treating the mechanism's presence as proof of every property associated with it.
C2-L's useful method is to name the assurance separately, attack it directly, and keep only the part the evidence actually supports.
When remote independence is still worth paying for
Independent administration remains valuable when the threat model includes a hostile Agent with root on the workstation, when capital size makes workstation compromise unacceptable, when organizational separation is required, or when operational consequence justifies the extra substrate.
The experiment removed a universal prerequisite. It did not remove the high-assurance profile.
The surviving rule
After falsification, the Finance rule is smaller and more explicit:
Every deployment must prove effect correctness. Credential/admin isolation is an additional deployment assurance whose required strength depends on the threat model and consequence severity.
A stronger system is not one that calls every concern “safety.” It is one that can say exactly which safety property has been proved, which one has failed, and which one has not yet been attempted.
Owner-record boundary
Why this public article is E2, not E4
The exact C2-L design and evidence remain retained by the Finance owner at local revision 391c11bb40f87a404a2d46463a1481beff9ab45e. At publication time, that owner record does not have a publicly reachable canonical repository URL. Web therefore does not substitute its summary for the missing primary record and does not present this article as publicly reproducible E4 evidence.
If Finance publishes the exact owner record later, this article can be revised and its public evidence level reconsidered without changing the experiment that originally produced the result.