fix(ci): clear the Vale findings that keep master red

CHANGELOG.md

@@ -29,14 +29,14 @@ All notable changes to the EthSystems Map are documented here.
 - chore: remove the dormant `weekly-updates/` directory and `scripts/weekly-summary.sh` (single entry, unused since 2026-01) ([#130](https://github.com/ethsystems/map/pull/130))
 - docs(domains): reframe [Domains index](domains/README.md), [Payments](domains/payments.md), [Identity & Compliance](domains/identity-compliance.md), [Funds & Assets](domains/funds-assets.md), [Trading](domains/trading.md), and [Data & Oracles](domains/data-oracles.md) to cover public-sector, NGO, and resilience contexts alongside FIs; add [Civic Coordination & Governance](domains/governance.md) domain; add `governance` to the use-case schema enum ([#170](https://github.com/ethsystems/map/pull/170), closes [#169](https://github.com/ethsystems/map/issues/169))
 - refactor(use-cases): rename `## 2) Additional Business Context` to `## 2) Additional Context` across [_template](use-cases/_template.md) and 23 use-case cards; strip reader-facing "Confidential context" placeholder line from 20 private-* cards ([#170](https://github.com/ethsystems/map/pull/170), closes [#169](https://github.com/ethsystems/map/issues/169))
-- feat(use-case): [Resilient Civic Participation](use-cases/resilient-civic-participation.md) -- credentialed petition protocol with per-signer forward-secure ratcheting, blob-anchored signature batches, and a chain-state-only resolution SNARK (ECI, repository governance, workplace organising); adds [Approach: Civic Participation](approaches/approach-civic-participation.md) and generic patterns [Forward-Secure Pseudorandom Tree](patterns/pattern-forward-secure-pseudorandom-tree.md) and [Blob-Anchored State With KZG Dispute](patterns/pattern-blob-anchored-state-with-dispute.md) ([#165](https://github.com/ethsystems/map/pull/165))
+- feat(use-case): [Resilient Civic Participation](use-cases/resilient-civic-participation.md) -- credentialed petition protocol with per-signer forward-secure ratcheting, blob-anchored signature batches, and a resolution SNARK over chain state alone (ECI, repository governance, workplace organising); adds [Approach: Civic Participation](approaches/approach-civic-participation.md) and generic patterns [Forward-Secure Pseudorandom Tree](patterns/pattern-forward-secure-pseudorandom-tree.md) and [Blob-Anchored State With KZG Dispute](patterns/pattern-blob-anchored-state-with-dispute.md) ([#165](https://github.com/ethsystems/map/pull/165))
 - chore(approach): I2U analysis pass across [Private Payments](approaches/approach-private-payments.md), [White-Label Deployment](approaches/approach-white-label-deployment.md), and [Private Broadcasting](approaches/approach-private-broadcasting.md). Adds [Self-Custodial Deployment](approaches/approach-white-label-deployment.md) (context: i2u) to White-Label. Relabels L1 Shielded Payments, Stateless Plasma, and Private Rollups from `i2i` to `both` where the underlying technology already serves end users. Closes [`#124`](https://github.com/ethsystems/map/issues/124) ([`#167`](https://github.com/ethsystems/map/pull/167))
 - feat(pattern): [Private Information Retrieval](patterns/pattern-private-information-retrieval.md), plugs client-side query leakage in shielded-pool path retrieval and note discovery, and applies to any indexed lookup whose index is itself sensitive ([`#168`](https://github.com/ethsystems/map/pull/168), companion to [ethsystems/pocs#68](https://github.com/ethsystems/pocs/issues/68))
 - feat(pattern): [Immutable Guarantees](patterns/pattern-immutable-guarantees.md), separating mutable operational parameters from immutable safety invariants, with a published invariant set that survives hostile operators ([#166](https://github.com/ethsystems/map/pull/166), closes [#127](https://github.com/ethsystems/map/issues/127))
 - fix(domains): refresh Adjacent vendors across [payments](domains/payments.md), [custody](domains/custody.md), [data-oracles](domains/data-oracles.md), [funds-assets](domains/funds-assets.md), [identity-compliance](domains/identity-compliance.md), and [trading](domains/trading.md). Remove Chainlink ACE (weak CROPS fit on openness and censorship resistance) and backfill with CROPS-aligned vendors already documented in [vendors/](vendors/) ([#164](https://github.com/ethsystems/map/pull/164)).
 - fix(ci): stabilize [full markdown link checks](.github/workflows/link-check-full.yml) by ignoring bot-blocked external references and repairing stale internal links ([#163](https://github.com/ethsystems/map/pull/163))
 - feat(schema): flip [pattern.json](scripts/schemas/pattern.json) and [validate-patterns.js](scripts/validate-patterns.js) to strict v2. All v1 aliases (`os`, `privacy`, `security` CROPS keys; `PoC`/`pilot`/`prod`/`experimental` maturity values; `privacy_goal`, `assumptions`, `dependencies`, `## Ingredients`, `## Guarantees` section names) now fail validation instead of warning. ([#156](https://github.com/ethsystems/map/pull/156))
-- feat(schema): approach template v2 -- replace [_template.md](approaches/_template.md) with the v2 skeleton from [#151](https://github.com/ethsystems/map/issues/151) and update [validate-patterns.js](scripts/validate-patterns.js) to check v2 sections (`## Problem framing`, `## Approaches`, `## Comparison`, `## Persona perspectives`, `## Recommendation`, `## Open questions`), required frontmatter (`title`, `status`, `last_reviewed`, `use_case`, `primary_patterns`), and the `^Approach:\s` title prefix. Lenient mode (warnings only) until a future strict-flip ([#161](https://github.com/ethsystems/map/pull/161))
+- feat(schema): approach template v2 -- replace [_template.md](approaches/_template.md) with the v2 skeleton from [#151](https://github.com/ethsystems/map/issues/151) and update [validate-patterns.js](scripts/validate-patterns.js) to check v2 sections (`## Problem framing`, `## Approaches`, `## Comparison`, `## Persona perspectives`, `## Recommendation`, `## Open questions`), required frontmatter (`title`, `status`, `last_reviewed`, `use_case`, `primary_patterns`), and the `^Approach:\s` title prefix. Lenient mode (warnings, not errors) until a future strict-flip ([#161](https://github.com/ethsystems/map/pull/161))
 - refactor(approach): port 9 approach cards in [approaches/](approaches/) to v2 schema (frontmatter, per-sub-approach YAML blocks, comparison table, persona perspectives, recommendation) ([#160](https://github.com/ethsystems/map/pull/160), [#151](https://github.com/ethsystems/map/issues/151))
 - chore(approach): remove `approaches/approach-privacy-standards-survey.md` (does not fit v2 schema; relocation tracked in [#159](https://github.com/ethsystems/map/issues/159)) ([#160](https://github.com/ethsystems/map/pull/160))
 - feat(use-case): [Resilient Disbursement Rails](use-cases/resilient-disbursement-rails.md) -- humanitarian disbursement to recipients in adversarial jurisdictions, with off-ramp unlinkability as the primary cryptographic requirement ([#157](https://github.com/ethsystems/map/pull/157))

CONTRIBUTING.md

@@ -11,7 +11,7 @@
 
 ### Adding an Enterprise Use Case
 
-1. Check [use-cases](./use-cases/) and [approaches](./approaches/) directories first
+1. Check the [use-cases](./use-cases/) and [approaches](./approaches/) directories before starting
 2. Create a new file describing your use case
 3. Submit a Pull Request using the use-case [template](./use-cases/_template.md)
 
@@ -66,7 +66,7 @@ CROPS are the four non-negotiable properties defined by the Ethereum Foundation.
 
 In I2U contexts, `medium` requires a concrete user escape path such as forced withdrawal, credential portability, or an L1 exit. Without that, the institution is the effective point of control over user participation.
 
-If the answer to the first two below questions is “yes” and the fallback is not independently enforceable, the score should usually be `low` or `none`.
+If the answer to both questions below is “yes” and the fallback is not independently enforceable, the score should usually be `low` or `none`.
 
 Use these to justify the score in one or two lines:
 

GLOSSARY.md

@@ -47,7 +47,7 @@ A dedicated network or service that publishes and stores the data required for D
 
 **Privacy Rollup**: ZK rollup designed for encrypted/private state (Aztec)
 
-**Validium**: Validity proofs on L1; data availability off-chain
+**Validium**: Validity proofs on L1. Data Availability off-chain
 
 **Volition**: Hybrid model allowing per-transaction choice between on-chain and off-chain DA
 
@@ -111,7 +111,7 @@ A dedicated network or service that publishes and stores the data required for D
 
 **TEE (Trusted Execution Environment)**: Hardware-based secure computation environment
 
-**MPC (Multi-Party Computation)**: Cryptographic technique for joint computation without revealing inputs
+**MPC (multi-party computation)**: Cryptographic technique for joint computation without revealing inputs
 
 **OPRF (Oblivious Pseudorandom Function)**: Cryptographic protocol where a server evaluates a pseudorandom function on a client's input without learning the input, and the client learns the output without learning the server's key. Used for private set intersection, password-hardening, and privacy-preserving authentication.
 

approaches/approach-private-bonds.md

@@ -123,7 +123,7 @@ example_vendors: [aztec, miden]
 
 **Summary:** Bonds as native private notes inside a privacy-native rollup; protocol-level privacy without dedicated circuit work.
 
-**How it works:** Aztec exposes private notes and contracts as first-class primitives; bond issuance, transfer, and coupon logic run in private functions with client-side proving. Incoming Viewing Keys (IVKs) provide account-level read access; nullifier keys are app-siloed for damage containment.
+**How it works:** Aztec exposes private notes and contracts as native primitives. Bond issuance, transfer, and coupon logic run in private functions with client-side proving. Incoming Viewing Keys (IVKs) provide account-level read access; nullifier keys are app-siloed for damage containment.
 
 **Trust assumptions:**
 - Sequencer for ordering (currently centralized in early deployments)
@@ -165,7 +165,7 @@ example_vendors: [taceo-merces]
 
 **Threat model:**
 - Collusion of two of the three nodes breaks confidentiality
-- Counterparty addresses leak; only amount confidentiality is provided
+- Counterparty addresses leak. Confidentiality covers amounts alone
 - Batch latency creates a settlement window
 
 **Works best when:**

approaches/approach-private-broadcasting.md

@@ -92,9 +92,9 @@ uses_patterns: [pattern-pretrade-privacy-encryption]
 example_vendors: [shutter]
 ```
 
-**Summary:** Transactions are encrypted before submission and decrypted only after ordering is fixed. See [Pre-trade Privacy Encryption](../patterns/pattern-pretrade-privacy-encryption.md) for the underlying primitive.
+**Summary:** Transactions are encrypted before submission. Decryption happens after ordering is fixed, never before. See [Pre-trade Privacy Encryption](../patterns/pattern-pretrade-privacy-encryption.md) for the underlying primitive.
 
-**How it works:** The user encrypts the transaction or expresses an intent under a private execution environment ([Shutter](../vendors/shutter.md); the earlier SUAVE design has been superseded by Flashbots BuilderNet). Submissions are ordered by the proposer first and decrypted afterwards by a threshold network. Content is not visible until the ordering is committed.
+**How it works:** The user encrypts the transaction or expresses an intent under a private execution environment ([Shutter](../vendors/shutter.md); the earlier SUAVE design has been superseded by Flashbots BuilderNet). The proposer orders submissions before any decryption. A threshold committee decrypts afterwards network. Content is not visible until the ordering is committed.
 
 **Trust assumptions:**
 - Threshold key holders (t-of-n) for decryption
@@ -108,7 +108,7 @@ example_vendors: [shutter]
 
 **Works best when:**
 - MEV protection is the primary concern and venue trust is unattractive
-- The chain or rollup supports encrypted-first ordering primitives
+- The chain or rollup supports ordering primitives that run over encrypted payloads
 - Threshold network trust is administratively manageable
 
 **Avoid when:**