save progress

docs/moat.md

@@ -103,6 +103,22 @@ rekor: { entries: ["<uuid>", ...] }   # optional (offline allowed)
 
 Turn VEX merging and severity logic into **programmable, testable algebra** with explainability.
 
+### Trust Algebra Foundation (Implemented 2025-12)
+
+The lattice engine uses **Belnap K4 four-valued logic** to aggregate heterogeneous security claims:
+
+* **K4 Values**: Unknown (⊥), True (T), False (F), Conflict (⊤)
+* **Security Atoms**: Six orthogonal propositions per Subject:
+  - PRESENT: component instance exists in artifact
+  - APPLIES: vulnerability applies to component (version match)
+  - REACHABLE: vulnerable code reachable from entrypoint
+  - MITIGATED: controls prevent exploitation
+  - FIXED: remediation applied
+  - MISATTRIBUTED: false positive indicator
+
+* **Claim Resolution**: Multiple VEX sources (CycloneDX, OpenVEX, CSAF) normalized to atoms, aggregated with conflict detection, then disposition selected via priority rules.
+* **Implementation**: `src/Policy/__Libraries/StellaOps.Policy/TrustLattice/` (110 tests passing)
+
 ### Model
 
 * **Domain:** partial order over vulnerability states: