Evidence record
Products & developer tooling
Every published claim on this page was checked by running the command shown. Claims that did not pass were withdrawn before publication; their count is stated below and the full record is available on request.
Measured 2026-08-23 · figures expire with the next publish run; the site is rebuilt from one figures ledger.
Research artifact · published claims
| Claim | How it was checked | Status |
|---|---|---|
| The regression test that ships with the connection fix fails against the pre-fix module and passes against the released one. | Rebuilt the pre-fix module in a scratch tree and ran the new test file against it — 5 failed, 2 passed of 7, reproducing the symptom the test was written for. The same file against the released source: 7 passed in 4.05 s. | published |
| The vault makes no network calls. | Most of its 157 tests are a parametrised static scan over 51 modules and 20 forbidden import roots, with an allowlist that is empty and a test that fails if it stops being empty. A Python audit hook around the login path caught a hostname resolution that the claim did not survive; that call was removed and the two log statements consuming the deleted field were rewritten. | published |
| The vault's self-destruct reports honestly when it cannot finish. | Independent verification against the pre-fix code returned 10 of 10 checks PASS with 4 residual observations, one of them a case where the routine reported success while the operating-system keychain entry survived it. It now reports the failure. | published |
| The XBRL server keeps stdout clean across a filing load, so nothing it logs can corrupt the transport. | Under the stdio transport, file descriptor 1 is the wire: a byte on it that is not a framed JSON-RPC message is a framing error by specification. A load path with no log file configured routed a library logger there. Three independent layers now hold it off — the real stdout duplicated onto a private descriptor with fd 1 re-pointed at stderr, a replacement sys.stdout object, and the library logger pinned to stderr with propagation off — under 16 tests, one of which asserts stdout stays clean across a filing load. | published |
| All five published packages install from their registries into a clean environment; the three Python packages run their command line, the two npm elements resolve their entry point. | Three PyPI installs at rc=0 in a throwaway venv with their console entry points exercised — golem, irondome, irondome-cli, arelle-mcp. Two npm installs (md-spawn 1.0.0, sst-spawn 2.0.0) into a throwaway project; each package's declared entry point (./dist/index.js) resolves. No browser run was performed. Releases across the three Python packages: 22 before today's uploads (4 / 11 / 7). | published |
12 claims tested · 5 published · 7 withdrawn before publication. Full evidence record available on request — king.hippopotamus@yahoo.com.
Author approval — 2026-08-23, hash f45b7c2a