August 23, 2026

RedFlag holds 3302 on the deploy host and appears in no compose file here, so the sweep that called 3302 free could not have seen it. The tree cannot answer this question; ss on the host can.

Pangolin runs on a different machine, so a loopback bind is unreachable from it -- forgejo-public binds its host address explicitly and joins the network for exactly this reason. An earlier commit removed the network block by reading a service that Pangolin does not front.

A sweep classifying repos for the public forge must not pick these up. The site is a rendered projection; serving it is a different act from publishing the source or the archive, and custody may never leave raw.

The custody repo is on master while the source repo, both workflows and forge-init's default_branch are on main. Renaming after a push leaves a stray branch and an empty default on the forge.

The clone found the second checkpoint uncommitted -- it seals 104 observations where the working store has 173, so a forge capture would have chained from cf5f8d6b and orphaned 374c8822. forge-verify.py reads deploy-key permissions back rather than trusting the create request.

Twelve steps, six of which stop at a credential or a live host. The acceptance test is that the laptop can be powered off and custody still grows; until step 8 is green the timer stays on, because Canada cannot be reconstructed backwards.

A capture push cannot trigger this workflow, so it carries its own schedule rather than widening the capture identity to defeat that. The image is built on the runner and shipped by docker save; the host builds nothing and holds no forge credential.

Write deploy key, one repository, not an account token and not Casey. The runner image is bare, so python3, git and ssh install first. Clone, sweep, checkpoint and push are one step, so the key's lifetime is one step and the trap fires on failure too.

Samaritan Portal has no network block -- Pangolin reaches it through the host port. caseytunturi attaches one; the newer pattern is the one to follow, and an external network that does not exist fails the container at start.

Samaritan Portal binds 3304 and is the pattern this follows; the repo I read instead was a superseded dev tree. Both the wrong correction and the sweep that missed every variable-prefixed bind are recorded in the file rather than quietly replaced.

Without it the user manager dies with the login session and the timer only exists while someone is signed in. On a laptop that travels, a day nobody logs in is a hole Canada cannot backfill.

The pattern came from caseytunturi.com and souveraine-website. Samaritan runs a React dev server and was never it, and nothing in the tree binds 3304, the port 3302 was said to clear.

Read for the site build, write for the sweep. The site renders evidence and must never be able to alter it. forge-init.py creates both repositories -- push-to-create is off on this installation.

The host gets dist/ and its build context in one tar, so it holds no forge credential. CI reads /.build-sha and /.custody-checkpoint back off the running container and fails unless both match what it built.

Two identifiers a reader can check without asking: which code rendered the page, which custody state it was rendered against. The footer also names the gap -- no digest published outside the authority holding custody -- so "verifies" cannot read as "tamper-proof".

Site is a projection: counts, hashes, diffs and provenance are read from the capture store at build time, so a claim without a capture cannot render. nginx-alpine behind Pangolin, loopback bind, build-sha verified. Route, port and runner remain Casey's to set.

Split the agency's own label from a determination about the record: 18 of 35 final rules touching 8 CFR 1208 have no prior proposed rule under the same RIN. Parser v2 disambiguates 9 duplicate provision paths, rederived from held bytes with no refetch. Projection rebuilds byte-identical from custody alone.

Every fetch now preserves raw bytes, retrieval time, hash, and a derivative keyed to parser version; rederive reparses held objects with no refetch. First Canadian custody point: 26 acts and regs, 13,545 provisions. The join resolves 31 of 33 amendment dates for 8 CFR 1208 and prints what it cannot match.

eCFR versioner gives point-in-time federal text with no key; Canada serves only current consolidation, so archive-on-ingest is mandatory. First artifact page renders the 8 CFR 1208.3 asylum fee change with full provenance.

The gate failed on name resolution for the package archive after apt had already succeeded in the same job -- intermittent, not configuration.

gcc-aarch64-linux-gnu ships the compiler, not the target startup files; without libc6-dev-arm64-cross ld cannot find Scrt1.o.

Eight checks after the link: AArch64 ELF, expected loader, no embedded RPATH, and every DT_NEEDED resolving to an aarch64 object inside the constructed sysroot. CI builds that sysroot in runner temp from empty, so nothing survives between runs to become part of the contract again.

It was a directory on one machine with no record of its contents, which made the only build that can take the panel reproducible by one person. 155 arm64 packages now resolve from 12 requirements derived from the kms feature, each verified against the archive index.

Compiled copies of the scanner carry its rule literals into the tree as bytes no reviewer reads, and they change on every run. Ignored.

Toolchain, aarch64 target, cross linker and smithay's dependency list are declared here instead of assumed from the build host. The phone KMS build is named as absent and why -- it needs a target sysroot no workflow can declare.

Selection for matrix gates is an explicit enumeration; the prefix count is a tripwire only. The pinned digest moves with it, so an un-updated copy stops the job rather than changing what "checked" means.

Same code; the revision now lands on the commit carrying the fork rationale, so a reader following the dependency arrives at the explanation.

Twenty commits carry internal topology in their diffs and two in their subjects. No secrets, and the tree at HEAD is clean, so the accepted history cannot excuse anything live.

Build and test stay; packaging, signing and archive publication do not, and neither does the operator harness. Four references to the build host become generic, package URLs point at the public forge, checkout is SHA-pinned.

The dependency was pinned to a host no one outside the house can reach, so a public clone could not resolve it. Same five patches, same tree; the revision moved because two commit identities were corrected before first publication.

tokio's File buffers; an append that returned Ok could still be in memory when the next take() read the file. Caught by multiple_appends_accumulate on a runner, never on a developer machine.

The previous run failed resolving docker.gitea.com; nothing in the tree changed.

The candidate ref never triggered anything, so a push to public produced no run and therefore no gate proof.

The mechanism carries the credential patterns it enforces, so the diff that adds it matches its own rules. The tree is exempted by manifest; the commit is reviewed here.

primary still carries the whole workflow; the public projection carries the three portable gates and nothing that names the build host.

The three portable jobs stay; the [host] packaging and archive publish move to packages.yml, which the public branch does not carry. The handoff document is operator archaeology and does not travel.

Fast-forward checked before the push, exact SHA read back after. Gitea is the only thing that publishes.

clippy's drain_collect fires under -D warnings on a newer toolchain than upstream pins. Two lines, same semantics.

The gate runs cargo fmt --check and the five patches were not formatted to upstream's style.

builder was a placeholder invented to keep an internal host name out of a public tree, and nothing serves it. The workflow now declares the toolchain and upstream's own dependency list for test_all_features, so the build contract is in the file rather than on one machine.

The mechanism install carries the scanner's own rule definitions; a gate cannot enter a repository it protects without its patterns appearing in that diff. The tree is exempted by manifest, the commit is reviewed here.

The gate travels with the repository because this installation cannot read a reusable workflow from a private repo. The pin makes drift a hard stop rather than a silent change in what "checked" means.

Upstream checks with test_all_features and the patches live in the paths that flag compiles, so the fork borrows that choice rather than inventing one. Anvil, Smallvil and the cache dance stay upstream's problem.

Five patches on a named upstream base, each with the failure it fixes. A reader should not have to diff 4000 commits to find 332 lines.

Fast-forward checked before the push, exact SHA read back after.

meson's policy/meson.build needs msgfmt to build the polkit policy file.

Upstream ships no CI in this tree, so the gate is meson's own contract: configure, build, test, with the optional introspection and idevice halves switched off so every run proves the same thing.

Fast-forward checked before the push, exact SHA read back after.

The repository had no README, which policy requires, and both Cargo.toml and the package recipe named the internal forge -- a current-tree finding the candidate scan cannot forgive.

172 observations, 75 objects, first checkpoint cf5f8d6ba5ba.

26 canadian acts and regulations, us federal captures, 104 observations.