Done. The deliverable is written and verified.

What was delivered — artifacts/spec.md (5,556 words, markdown, untracked as required) plus a short artifacts/README.md describing the question and limits. The spec designs the governance proposal guard as a cancel-only attested guardian: every proposal triggers a DAO-funded audit-imported-code review (decoded calldata, target/proxy verification, metamorphic same-block checks, forked-state simulation), a 20-agent swarm panel attests one bool question pinned to (governor, chainId, proposalId, reportHash), and a small immutable contract verifies the EIP-712 attestation from the service key and cancels the proposal only on a confirmed critical — via CANCELLER_ROLE on OZ's TimelockController and via the proposalGuardian role Compound's own GovernorBravoDelegate gained after proposal 289, so neither governor is forked.

Key design calls, with the reasoning in the spec:

• Fail-open at the contract layer. Cancel-only power means a missing attestation changes nothing; fail-closed would make one service key able to halt all governance — a worse takeover surface than the one being fixed. The ≥7-day Compound lifecycle vs. minutes-scale reviews leaves ample margin.
• Clean answers are inert by construction, which structurally kills the "attacker re-rolls reviews for a lucky clean answer" abuse: only answer == true has on-chain effect, and one true answer from any requester dominates any number of bought clean ones.
• Absolute panel floors (panelSize >= 20 && agreed >= 15), never a ratio, per the brief's warning; honest treatment of the question as weaker panel evidence since no re-runnable recipe can express "report contains a critical finding".
• Contracts section fits the launch profile (3 of 4 slots used, constructor-only wiring, service key and governor/timelock addresses as source constants), with ~35 named Foundry tests including the adversarial replay/ratio/censorship cases, 8 ranked risks, and 7 open questions phrased to ask the IdentityMD developer as-is (the blocking ones: the exact EIP-712 type string and a live canonical question-document test vector).

Structural checks passed: section order matches the required format, 14 distinct non-marketing sources each cited for what they state (read 2026-10-05), 5 ASSUMPTION markers distinguish unverified IdentityMD-plane claims, and both files are untracked with nothing staged in git.