APR-Lite Substrate v9: Governance-Layer Vulnerability Matrix

This technical note documents the governance-layer vulnerability matrix for the APR-Lite substrate governance platform at version 9. It identifies ten vulnerability classes — the places where governance substrates fail even when all functional tests pass — and describes the nature of each class and the governance mitigations implemented in response. The central thesis is that governance substrates require adversarial analysis distinct from functional testing. A substrate that passes all scenario tests may still be vulnerable to prompt-layer bypass attempts, silent contract fallbacks, semantic laundering across agent chains, authority-root misalignment, cascade timing exploits, and output classes that are technically admissible but substantively unsafe. This matrix names and addresses each class. Note on scope: Detailed test methodologies are withheld from this public summary. The vulnerability class names, descriptions, and mitigations are provided to support governance research and standards development without enabling exploitation of the specific vulnerabilities described.