THE SEQUENCE AND THE BOUNDARY. Financial Infrastructure Under AI Attack, Enriched Edition: On the Within-System Refusal, the Cross-Organizational Admission, and the Instantiation of A11–A16

In the last week of October and the first days of November 2026, seven incidents werereported in which AI-assisted attacks hit financial infrastructure across France, Belgium, the Eurozone, South Korea, Japan, fourteen countries, and the crypto markets. The reported pattern is the same in each: the attack is a sequence, each individual step of the sequence passes the per-transaction checks, and the sequence completes before any monitor sees it. The published base version of this paper (DOI 10.5281/zenodo.23968687) demonstrated thewithin-system refusal: a payment sequence, passing every per-transaction check, refused by a trajectory predicate before the money moves. It demonstrated one refusal, at oneboundary — the boundary of a single bounded system. This enriched version demonstrates the cross-organizational refusal. The incidents are notwithin-system events. France's incident crossed from a bank to a crypto exchange.Binance's crossed eleven blockchains. The fourteen-country campaign crossed two hundred organizations. The refusal that the incidents needed is a refusal that happens when one organization is about to admit another organization's agent to its customers, accounts, or transactions — and the artifact that makes that refusal possible is the inter-organizational layer A11–A16, proposed in DOI 10.5281/zenodo.22899244 and specified in DOI 10.5281/zenodo.23102907. This paper instantiates that layer. It states the Agent Certificate (A11), the Intent Envelope(A12), the Counterparty Admission Protocol (A13), the Action Vocabulary Mapping (A14), the Refusal as Wire Protocol (A15), and the Trace Ledger (A16) in operation across twomutually distrusting organizations. It presents a second worked run in which the same payment sequence is refused at the cross-organizational boundary, with both partiesverifying the refusal independently, without trusting each other. The paper does not claim any of the seven incidents would have been prevented. It claimsthat the cross-organizational refusal demonstrated here is the mechanism the incidents lacked, and that the mechanism is specified, instantiated, and verifiable — not hypothesized. Status is stated in the abstract rather than the residuals: the architecture is specified (Layer1 complete), the TLA+ modules are written but not yet model-checked (Layer 2), andhardware validation has not started (Layer 3). The paper demonstrates a specification-levelinstantiation of the inter-organizational layer; it does not claim a deployed cross-organizational payment system has been certified.