# Memoranda

Canonical machine-readable index for memoranda.

- **Public registry:** https://record.cybersecurityhq.com/memoranda
- **Record count:** 21

- [CHQ-SM-2026-002: Inability to Enumerate Operating Identities Invalidates Governance Assertions](./CHQ-SM-2026-002.md): v1.0 · ISSUED
- [CHQ-SM-2026-003: Autonomous & Non-Human Identity Delegation Constitutes a Governance Record](./CHQ-SM-2026-003.md): v1.0 · ISSUED
- [CHQ-SM-2026-004: Threat Model Scope Must Include Delegated Emergency Authority](./CHQ-SM-2026-004.md): v1.0 · ISSUED
- [CHQ-SM-2026-006: Incident Reporting Timelines and Governance Observability](./CHQ-SM-2026-006.md): v1.0 · ISSUED
- [CHQ-SM-2026-007: Identity Revocation as Governance Boundary](./CHQ-SM-2026-007.md): v1.0 · ISSUED
- [CHQ-SM-2026-008: Observability Limits in Distributed Execution Environments](./CHQ-SM-2026-008.md): v1.0 · ISSUED
- [CHQ-SM-2026-009: SaaS Integration Topology Produces Ungovernable Transitive Exposure](./CHQ-SM-2026-009.md): v1.0 · ISSUED
- [CHQ-SM-2026-011: Delegated Authority as an Exploitable Primitive in Autonomous Execution Environments](./CHQ-SM-2026-011.md): v1.0 · ISSUED
- [CHQ-SM-2026-012: The Developer Supply Chain Is Now Self-Propagating](./CHQ-SM-2026-012.md): v1.1 · ISSUED
- [CHQ-SM-2026-013: Exploitation Timing Is Structurally Independent of Disclosure Timing](./CHQ-SM-2026-013.md): v1.1 · ISSUED
- [CHQ-SM-2026-014: Publication Authority Inheritance as Structural Attack Surface](./CHQ-SM-2026-014.md): v1.0 · ISSUED
- [CHQ-SM-2026-015: The Management Plane as the Primary Target Class](./CHQ-SM-2026-015.md): v1.1 · ISSUED
- [CHQ-SM-2026-016: Credential Rotation Does Not Achieve Revocation](./CHQ-SM-2026-016.md): v1.0 · ISSUED
- [CHQ-SM-2026-001: CHQ External Risk Recognition Memo](./CHQ-SM-2026-001.md): v1.0 · ISSUED
- [CHQ-SM-2026-005: CHQ Pressure Memo — February 2026](./CHQ-SM-2026-005.md): v1.0 · ISSUED
- [CHQ-SM-2026-010: CHQ Pressure Memo — March 2026](./CHQ-SM-2026-010.md): v1.0 · ISSUED
- [CHQ-SM-2026-017: Vendor Advisory Precedence Over Federal Exploitation Confirmation, June to September 2026](./CHQ-SM-2026-017.md): v1.0 · ISSUED
- [CHQ-SM-2026-018: Criterion Invalidation Under Construct Validation: The SC-2026-006 v1.0 Case](./CHQ-SM-2026-018.md): v1.0 · ISSUED
- [CHQ-SM-2026-019: Intake Completeness Reconciliation, March to September 2026](./CHQ-SM-2026-019.md): v1.0 · ISSUED
- [CHQ-SM-2026-020: AI Infrastructure Exploited as a Credential Control Plane](./CHQ-SM-2026-020.md): v1.0 · ISSUED
- [CHQ-SM-2026-021: Materiality Determination in the Cybersecurity Disclosure Stream, March to September 2026](./CHQ-SM-2026-021.md): v1.0 · ISSUED