Evidence record
Security operations & governance
Every published claim on this page was checked by running the command shown. Claims that did not pass were withdrawn before publication; their count is stated below and the full record is available on request.
Measured 2026-08-23 · figures expire with the next publish run; the site is rebuilt from one figures ledger.
Research artifact · published claims
| Claim | How it was checked | Status |
|---|---|---|
| The standing register holds 21 numbered exposures, each carrying a severity and a state. 18 of the 21 also carry the date the claim was last checked against the live host; the three that do not are two standing structural entries and one the register itself marks as never verified. States resolve to 4 OPEN, 4 CONTROLLED, 3 ACCEPTED, 1 PARTIAL and 1 CLOSED, with the remainder carrying compound states. | grep -oE 'SR-[0-9]+' <register> | sort -u | wc -l → 21 ; grep -E '^\| SR-[0-9]+' <register> | grep -cE '20[0-9]{2}-[0-9]{2}-[0-9]{2}' → 18 rows carry a last-checked date ; grep -oE '\| (OPEN|CLOSED|CONTROLLED|ACCEPTED|PARTIAL)' <register> | sort | uniq -c → the state mix | published |
| The decision log is append-only, 510 lines, and holds 4 dated rulings — one ruling being one dated section — the earliest dated 2026-07-23 and the most recent 2026-08-23, inside a file whose earliest referenced date is 2026-03-30. Two of the four carry an explicit approve-with-conditions verdict; the other two are an investigation plan and an execution record. | grep -cE '^## 20' <decisions> → 4 ; wc -l <decisions> → 510 ; the earliest and latest dated section headers in the same file → 2026-07-23 and 2026-08-23 ; the earliest date token anywhere in the same file → 2026-03-30 | published |
| The most recent ruling carries the four-part shape drawn above: 6 pre-ruling live checks numbered V1–V6, 12 numbered conditions all marked mandatory, and 8 post-arm checks numbered P1–P8 to be run attended. | grep -cE '^\| V[0-9]' <decisions> → 6 ; grep -cE '^[0-9]+\. \*\*' over the ruling's condition block → 12 ; grep -cE '^- \[ \] \*\*P[0-9]' <decisions> → 8 ; grep -nE '^### [0-9]\.' <decisions> → the four-part shape ; the block's own heading states MUST for all twelve | published |
| The incident log is separate and append-only, with 4 entries under a fixed vocabulary: 2 confirmed, 1 benign after investigation, and 1 documented negative result — a hunt where every candidate proved already patched, kept because the method lesson was worth keeping. | grep -cE '^- \*\*20' <incidents> → 4 | published |
| One audit trail carries both layers: 353 machine-appended entries across 2,051 lines, on 143 distinct days inside a 146-day window. The dispatcher every actor writes through recognises 12 event types and records anything else as an unknown event rather than accepting it. | grep -cE '^ - timestamp:' <audit> → 353 ; wc -l <audit> → 2051 ; grep -oE '20[0-9]{2}-[0-9]{2}-[0-9]{2}' <audit> | sort -u | wc -l → 143 ; grep -cE '^ [A-Z_]+\)' <dispatch> → 12 | published |
| The host sensor is one file, 1,611 lines, standard library only, scoring 10 named layers on a weighted average. On an ordinary day it makes 288 three-layer passes, 96 ten-layer passes, 24 janitor runs, 24 outbound-only linter runs and 1 daily digest — four different units of work that are never summed into one number. | wc -l <sensor> → 1611 ; the layer table and weight table in the same file → 10 layers ; the schedule lines that drive it → 5 / 15 / 60-minute modes plus the daily digest | published |
| The gate is the required last step before this site is published: 7 checks defined, of which 6 run in fixed order on every publish and a 7th runs when an evidence bundle is passed, exiting non-zero if any one of them fails, and the tree it guards carries the origin declaration the gate demands. Its rule file carries 43 rules in five categories — 11 topology, 5 identity, 16 content-legal, 6 disclosure, 5 tone — and 2 of those categories have their matched text redacted in the gate's own output, so the log cannot leak what it caught. Self-excluded paths are printed on every run, including passes. | grep -c '^def check_' <gate> → 7 ; the check list the gate assembles before running → 6 unconditional, 1 appended only when an evidence bundle is given ; a rule-array count over <denylist> → 11 / 5 / 16 / 6 / 5 = 43 ; grep -n 'REDACT_CATEGORIES' <denylist> → 2 categories ; the origin declaration the gate reads for same-origin resolution is present at the root of the tree this site is built from | published |
| The document-render sandbox is a 405-line wrapper, a 92-line seccomp filter and a 180-line policy whose single rule is that calling the raw converter is an incident. The filter inspects the domain argument of the socket call and refuses the two internet families, so a crafted document cannot fetch even where a separate network namespace is unavailable. Running the filter's self-test under the same BPF program returned both internet families denied with EACCES and the local family allowed. | wc -l over the wrapper, the filter and the policy → 405 / 92 / 180 ; grep -nE 'AF_INET|__NR_socket|EACCES' over the filter source → the denial ; the filter's self-test, which installs the same BPF program and then opens sockets under it, was run on 2026-08-23 → AFINET=DENIED, AFINET6=DENIED, AFUNIX=OK, exit 0. | published |
| The container control plane is built default-deny: the backend never mounts the container socket and speaks to a scoped proxy that allows 6 verb groups, denies 17, and itself publishes no port. Its security document publishes 7 residual risks against itself, and the states are published rather than netted: 3 still open, 1 recorded closed pending live verification, 2 accepted, 1 tracked as belonging to another surface. The panel is built and checked, not permanently deployed. | count of allowed and denied verb-group flags in the panel's compose file → 6 and 17 ; grep -cE '^\| \*\*R[0-9]' <panel-security> → 7 ; the status column reads 4 OPEN, 2 ACCEPTED and 1 tracked separately, and the as-built section then records the first of those four closed pending live verification ; the panel's own status line records built-and-checked, not deployed | published |
12 claims tested · 9 published · 3 withdrawn before publication. Full evidence record available on request — king.hippopotamus@yahoo.com.
Author approval — 2026-08-23, hash dc3a6635