{
  "schema": 2,
  "generated_at": "2026-11-12T23:30:31-05:00",
  "source_head": "9b96466",
  "window": "2026-11-12",
  "counts": {
    "commits": 11,
    "agent_authored": 11,
    "gates_fired": 2,
    "refusals": 3
  },
  "entries": [
    {
      "ts": "2026-07-30T00:53:37-04:00",
      "kind": "refused",
      "title": "The PII guard refused three shelf records before commit — a name-field pattern beside household vocabulary",
      "detail": "one real deny-path event: the copy changed, the guard did not",
      "proof": {
        "hash": "5537488",
        "scope": "local",
        "ref": "PII-guard run over a staged page — its transcript is printed below, verbatim"
      },
      "lane": "governance",
      "capture": [
        "$ python3 hooks/checks/pii_guard --scan-paths src/pages/tools/index.astro",
        "pii_guard[scan-paths]: 3 finding(s), 0 files unscanned — category · file:line (values never shown)",
        "  [unmarked-household-record]",
        "    src/pages/tools/index.astro:18",
        "    src/pages/tools/index.astro:19",
        "    src/pages/tools/index.astro:27",
        "→ fixed content-side in 5537488: the data key became \"tool\", not \"name\" — the guard was not touched",
        "$ python3 hooks/checks/pii_guard --scan-paths src/pages/tools/index.astro",
        "pii_guard[scan-paths]: 0 findings, 0 files unscanned",
        "captured 2026-07-30 · the guard's own output, verbatim"
      ]
    },
    {
      "ts": "2026-07-30T00:54:05-04:00",
      "kind": "gated",
      "title": "Publishing stays behind the freeze — tonight shipped dark, and the promote remains a human act",
      "detail": "the staged-then-promote road is rehearsable end to end without a byte leaving the machine",
      "proof": {
        "hash": "cf4386b",
        "scope": "local",
        "ref": "publish-gate rehearsal — the gate held at the human promote step"
      },
      "lane": "governance"
    },
    {
      "ts": "2026-07-30T19:05:00-04:00",
      "kind": "refused",
      "title": "The image gate refused every raster on the site — including four portraits it had passed clean an hour earlier",
      "detail": "the gate could not see the metadata classes it advertised; the fix was to the gate, and it immediately refused the files it had been passing",
      "proof": {
        "hash": "aa894e9",
        "scope": "local",
        "ref": "the gate's own output before and after the rewrite, printed below"
      },
      "lane": "governance",
      "capture": [
        "$ hooks/checks/exif_check public/mascot/favicon-32.png public/crew/*.jpg",
        "exif_check: 0 findings                                  # the OLD gate, exit 0",
        "→ but those files carry an eXIf chunk, a 459-byte Adobe XMP packet,",
        "  and a Photoshop 8BIM block. The gate read IFD0 only, so XMP, IPTC and",
        "  PNG text chunks were unreachable — it could not see its own subject.",
        "",
        "$ hooks/checks/exif_check public/mascot/favicon-32.png public/crew/*.jpg",
        "exif_check: BLOCKED — public/mascot/favicon-32.png carries PNG eXIf →",
        "  ExifOffset, ColorSpace, PixelXDimension, PixelYDimension;",
        "  PNG iTXt [XML:com.adobe.xmp] (values never shown)",
        "exif_check: BLOCKED — public/crew/surveyor.jpg carries APP1/Exif → …;",
        "  APP13/Photoshop-IPTC (values never shown)                # the NEW gate, exit 1",
        "",
        "$ tools/strip_raster_metadata.py <the seven flagged rasters>",
        "$ hooks/checks/exif_check public/crew/*.jpg public/mascot/* public/og.png",
        "exif_check: 0 findings (9 raster(s) walked: Exif incl. SubIFD+GPS, XMP, IPTC, PNG text)",
        "captured 2026-07-30 · the gate's own output, verbatim · nothing had leaked; nothing would have been caught if it had"
      ]
    },
    {
      "ts": "2026-07-30T20:55:40-04:00",
      "kind": "refused",
      "title": "The index-posture gate refused tonight's publish — robots.txt and the noindex header had been contradicting each other the whole time",
      "detail": "fired at 17f95a1, exit 1, at the first step of the publish road; resolved by a ruling rather than by touching the gate. Kept on the record permanently: the catch is the evidence",
      "proof": {
        "hash": "17f95a1",
        "scope": "local",
        "ref": "the gate's own output either side of the ruling, printed below"
      },
      "lane": "governance",
      "capture": [
        "$ python3 hooks/checks/index_posture                     # at 17f95a1, before the ruling",
        "index_posture: BLOCKED — robots.txt says INDEXABLE but the X-Robots-Tag header says",
        "  SEALED. The header wins, so the served posture is SEALED whatever robots.txt claims.",
        "  This is a decision, not a typo. Pick one and make both files say it:",
        "    GO LIVE  — delete the X-Robots-Tag block from vercel.json; leave robots.txt as 'Allow: /'",
        "    STAY SEALED — set robots.txt to 'Disallow: /'; leave the noindex header in place",
        "                                                          # exit 1 — publish stopped at step 0",
        "",
        "→ Neither file was wrong on its own, which is why nothing else caught it: every header",
        "  check printed OK and robots.txt read exactly as intended. The defect lived BETWEEN",
        "  them — two declarations of one posture, free to disagree, with the header silently",
        "  winning. The gate refused to guess and named both lawful ways out.",
        "",
        "→ The operator ruled GO LIVE: a site whose claim is 'steal this' does not seal itself",
        "  from the readers it is written for. The X-Robots-Tag block was deleted.",
        "",
        "$ python3 hooks/checks/index_posture                     # after the ruling",
        "index_posture: 0 findings — robots.txt and X-Robots-Tag both say INDEXABLE",
        "                                                          # exit 0",
        "captured 2026-07-30 · the gate's own output, verbatim · FIRED AND RESOLVED"
      ]
    },
    {
      "ts": "2026-07-30T22:20:41-04:00",
      "kind": "gated",
      "title": "The identity deny-list holds one placeholder token — the perimeter is not real yet; the operator ruled to arm over the warning, not seed it",
      "detail": "the standing warning on autonomy's last step, kept on the record before and after arming. Not a gate exiting 1: the perimeter check reports a count and hands the decision to a human, who took it. What actually reads the published bytes is pii_guard at block and anon_lint — both 0 findings",
      "proof": {
        "hash": "c1bd6bd",
        "scope": "local",
        "ref": "the perimeter check's own output at HEAD, printed below, and the arming gate it feeds"
      },
      "lane": "governance",
      "capture": [
        "$ ./site_govcheck.sh                                     # at HEAD",
        "govcheck: manifest 9 path(s) checked · deny-list tokens=1 (count only)",
        "govcheck: refusal re-fires — anon_lint=fired · pii_guard=fired",
        "govcheck: route coverage — gate + runbook §4 vs routes: ok",
        "govcheck: parity: unverifiable (live canary unfetchable — older deploy or offline)",
        "govcheck: publishes logged=4",
        "govcheck: OK                                             # exit 0 — the perimeter stands",
        "",
        "→ tokens=1 is the whole finding, and it says the perimeter is NOT YET REAL.",
        "  The deny-list is the exact-token identity list anon_lint refuses against,",
        "  and it holds ONE PLACEHOLDER: the sentinel this very check constructs to",
        "  prove the refusal path still fires. Nothing real has ever been put on it.",
        "  So the mechanism is wired and demonstrably firing, and it is pointed at",
        "  nothing — a working alarm on an empty perimeter. anon_lint fail-closes on",
        "  an absent, empty or malformed list, which is why the count can be trusted",
        "  to mean what it says.",
        "",
        "→ what that warned about, from the arming gate's own text (quoted from",
        "  ops/arm_autodeploy.sh — an agent authored it and may not run it):",
        "",
        "    deny-list: 1 non-comment token(s). One token is the fire-test sentinel class,",
        "    not a seeded list. anon_lint fail-closes on absent/empty — that refusal is the",
        "    control working, but YOU decide whether 1 token(s) is the #342 seed set.",
        "    Seeded to your satisfaction, and lift the freeze to ZERO-TAP deploys on every commit? [y/N]",
        "",
        "→ THE RULING: the operator decided to ARM OVER THIS WARNING rather than seed",
        "  the list. Seeding an identity list is a human-maker act; so is judging that",
        "  it is not yet needed. Both were his to take and he took the second one. That",
        "  is a decision on the record, not an oversight, and this entry reads the same",
        "  either side of it. It comes off the ledger when the list is seeded, not when",
        "  the site goes live.",
        "",
        "→ so what is actually holding the line over the bytes readers receive? Not this",
        "  list. Two content gates, both blocking, both reporting nothing:",
        "",
        "$ find dist -type f -print0 | xargs -0 python3 hooks/checks/pii_guard --scan-paths",
        "pii_guard[scan-paths]: 0 findings, 10 files unscanned",
        "  UNSCANNED  dist/fonts/geist-sans-variable.woff2  (non-text suffix)",
        "  … 9 more: 5 crew portraits, the mono font, 2 mascot rasters, og.png",
        "$ find dist -type f -print0 | xargs -0 python3 hooks/checks/anon_lint --paths",
        "anon_lint: 0 findings, 10 files unscanned",
        "  … the same ten binaries (binary suffix)",
        "",
        "  Read the second number too: ten files are UNSCANNED, not clean. Both",
        "  scanners skip binary suffixes, so the fonts and rasters ship on the strength",
        "  of exif_check and of who made them, and nobody reads their bytes.",
        "  Run here over dist/, the built site. At publish the same two scanners run",
        "  over .vercel/output — the exact bytes that upload — and neither road to",
        "  production can get past a finding in them.",
        "captured 2026-07-31 · the checks' own output, verbatim · STANDING, ARMED OVER"
      ]
    },
    {
      "ts": "2026-08-01T23:40:00-04:00",
      "kind": "learned",
      "lane": "honesty",
      "title": "The homepage said 'today' about yesterday, then stamped a fresh date over a stale count",
      "detail": "a rolling 24-hour window is not a calendar day, and a validator that runs before the write it depends on can never advance",
      "proof": {
        "hash": "151834d",
        "scope": "local",
        "ref": "the homepage counts the day it says it counted"
      }
    },
    {
      "ts": "2026-11-12T14:29:26-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "627a947",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T14:36:05-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "40f2750",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T14:36:14-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "d181871",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T14:55:42-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "363164f",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T14:55:49-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "83ac503",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T20:29:43-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "25426c4",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T20:34:28-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "7fe5c0a",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T20:34:45-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "b7db837",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T20:41:55-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "7329a55",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-12T20:59:18-05:00",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "6c94ff5",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    },
    {
      "ts": "2026-11-13T04:30:00Z",
      "kind": "shipped",
      "title": "A site commit — message withheld",
      "detail": "commit messages are not published; the sha and the count are the record",
      "proof": {
        "hash": "9b96466",
        "scope": "local",
        "ref": "commit in the site repo"
      },
      "lane": "site"
    }
  ]
}