Release
- Deploys run through an allowlisting script that stages only approved file types and aborts if any internal Markdown would reach production. Direct
wrangler pages deployis banned because it uploads the whole repository and bypasses those denylists. - Deploys require the human owner's word. Agents maintain the tree; they do not push production without authorization.
Stack
- Hosting · apex
- Cloudflare Pages at hool.dev. Static site. No app server, no runtime framework in the browser—HTML, CSS, and self-hosted assets only.
- Type · art
- Self-hosted JetBrains Mono (SIL OFL). Homepage art is procedural and computed at view time—no image assets for the art. This page, /about/, and /now/ self-host fonts; preserved gallery, attractor, and archived surfaces may load Google Fonts.
- Charts
- /receipts/ vendors uPlot v1.6.31 (MIT, © Leon Sorokin 2022) at
/receipts/vendor/uPlot/. Loaded only on that route; the JS lives in the served tree, no CDN call at view time. A no-JS table is rendered inline so the chart's numbers are still readable when scripts are off. - Lab · simplex-noise
- /lab/simplex-noise/ vendors simplex-noise (MIT, © Jonas Wagner 2018) at
/lab/simplex-noise/assets/. Loaded only on that additive route; the JS lives in the served tree, no CDN call at view time. Taste-gated; not production until the owner’s deploy word.
Palette & contrast
The design system names ten CSS custom properties (above in Stack, also set in this page's :root). The brand promise — if the site says it, you can check it — extends to the palette: the visitor runs the math, not the maintainer. Below is the literal hex map and a visitor-side WCAG 2.1 contrast verifier. It honors prefers-color-scheme; the night palette is the default and the paper palette sits behind a <details>.
What the verifier computes
Relative luminance per WCAG 2.1 §2.3.1: each sRGB channel is linearized (s ≤ 0.03928 → s/12.92, else ((s+0.055)/1.055)^2.4), then L = 0.2126·R + 0.7152·G + 0.0722·B. Contrast ratio (L₁+0.05)/(L₂+0.05) where L₁ is the lighter color. Thresholds from WCAG 2.1 §1.4.3 and §1.4.11: AA normal 4.5, AA large 3.0, AAA normal 7.0, AAA large 4.5, UI components 3.0. The same math runs on every page via scripts/contrast-cli.js in CI; this is the visitor-side mirror.
Default is --fg on --bg (night palette) — the same pair running this page. Click any swatch's "use" button to load it into the matching slot.
Network
- Serving · logs
- Cloudflare Pages serves the site and keeps standard edge logs.
- Measurement
- Production currently injects a Cloudflare Web Analytics / RUM beacon, but the site's Content Security Policy blocks that third-party request. Browser measurement may be enabled later under this disclosure.
- Outbound
- Links to GitHub, LinkedIn, Substack, npm, PyPI, Polar, and other properties leave hool.dev when followed. Material browser-side services and data collection are named in privacy; that disclosure changes when the implementation does.
The revisitable-dependency law remains: external services and measurement are allowed when they improve the site or its operation. The retired "zero" rule is historical, not a constraint.
Audit the HTTP response headers any site sends. Paste the output of curl -sI <url> (or your browser's response-headers pane) below; the inspector runs eight OWASP / Mozilla-grade rule checks and renders PASS · INFO · WARN · FAIL per header. Nothing leaves your browser.
JavaScript is off. The inspector needs JS to parse the headers and render the rule table. Run curl -sI https://hool.dev/ in your terminal, or visit Mozilla Observatory / SecurityHeaders.com for server-side audits.
| Header | Status | Finding |
|---|
What the eight rules check (read the source: ~120 lines of hand-rolled JS below in this page)
- Content-Security-Policy
- PASS if
default-src(or stricter) is set and no'unsafe-eval'or wildcard*appears inscript-src. WARN if'unsafe-inline'appears (flagged with rationale — hool.dev ships this trade-off to allow its inline critical CSS / same-origin scripts). FAIL ifscript-srcis missing entirely, or contains'unsafe-eval'. - Strict-Transport-Security
- PASS if
max-age≥ 31,536,000 (one year) ANDincludeSubDomainsorpreload. FAIL ifmax-age=0or absent. - X-Frame-Options
- PASS on
DENYorSAMEORIGIN. hool.dev shipsSAMEORIGIN— same-origin framing of/gallery/iframes of/attractors/*is intentional. Modern browsers prefer CSPframe-ancestors; XFO remains a defence-in-depth signal. - X-Content-Type-Options
- PASS on
nosniff. FAIL if absent (MIME-sniffing risk). - Referrer-Policy
- PASS on
strict-origin-when-cross-origin/no-referrer/same-origin/strict-origin. FAIL onunsafe-urlorno-referrer-when-downgrade. - Permissions-Policy
- PASS if at minimum
geolocation=(),microphone=(),camera=()(or stricter) are present — these are the high-leverage features used in clickjacking / covert-recording attacks. - Cross-Origin-Opener-Policy
- INFO if absent (the inspector does not penalise absence). PASS on
same-originor stricter. Required only if SharedArrayBuffer / high-resolution timers are needed. - Cross-Origin-Embedder-Policy
- INFO if absent. PASS on
require-corporcredentialless. Same precondition as COOP; not shipped on most static sites.
Audit the body the apex actually serves. Paste the raw body from curl -s <url> (or your browser's view source) below; the inspector computes its SHA-256 via SubtleCrypto.digest and compares against the deploy-time capture at /body-snapshot.txt. A Fetch live hool.dev body button prefills the snapshot file the lane captured at last deploy, so you can audit whether the snapshot is the bytes apex actually serves — without trusting a third party. The verdict grid also surfaces a capture-age auditor's pick (P38): the deploy-time capture's age in whole UTC days against a 90-day deployed-route shelf, with FRESH / AGING / STALE / FALSIFIED bands. A separate Refresh capture-age pick button re-runs just the age check without re-auditing the bytes. Nothing leaves your browser.
JavaScript is off. The auditor needs SubtleCrypto.digest to compute SHA-256 in-browser. Run curl -s https://hool.dev/ | shasum -a 256 in your terminal to get the same hash by hand. The /body-snapshot.txt capture is also committed to the repo so you can git show origin/main:public/body-snapshot.txt | shasum -a 256 for the deploy-time fingerprint.
What the five checks verify (read the source: ~150 lines of hand-rolled JS below)
- Capture age (timestamp auditor)
- P38 —
fetch('/body-snapshot.txt', {method:'HEAD'}).headers.get('date')→ compute age in whole UTC days against today's UTC midnight. Shelf policy: deployed-route = 90d (sibling of P22-P37 inspector family). FRESH ≤72d (green), AGING 73-90d (amber), STALE >90d (red, past shelf), FALSIFIED capture date in the future (anti-tamper signal — snapshot was tampered with or its Date header rotated forward). The timestamp-auditor verdict is the single oldest stale claim this inspector can flag: if FRESH the inspector can keep its assertion ("bytes apex served today match last deploy"), if STALE the visitor knows the snapshot's capture is older than the shelf and a new deploy is due. - Content-Type parsed
- Light regex pull of
media-type+ optionalcharsetfrom the visitor-pasted header. INFO if absent — the visitor can paste one if they have it; the inspector still computes the SHA-256 regardless. - Body SHA-256 (your bytes)
- SubtleCrypto.digest('SHA-256', visitorBytes) → hex. The literal JS function call is visible in the module below; no library.
- Body SHA-256 (snapshot)
- SubtleCrypto.digest('SHA-256', fetch('/body-snapshot.txt').then(r=>r.arrayBuffer())) → hex. Same SubtleCrypto.digest path; the snapshot bytes are the deploy-time capture from deploy.sh.
- Verdict
- PASS if your sha-256 == snapshot sha-256 (the bytes apex served at last deploy match what the visitor just received). FAIL on mismatch (apex changed since the deploy-time capture, or visitor fetched a different URL). INFO if only one side is available (visitor hasn't pasted yet, or snapshot fetch failed). The capture-age row is independent of this verdict — a STALE snapshot can still PASS the byte comparison (the bytes ARE the bytes apex served; they're just older than the shelf).
Provenance
The homepage (THE FLOOR) was built unattended by an autonomous AI agent fleet from a single open brief on 2026-06-12, then re-audited unattended the same day: every count, status, and price re-verified against fleet receipts; stale numbers corrected; unprovable numbers removed. Previous build preserved at /gallery/. Receipts at /receipts/. The site is maintained by AI agents under the journal/wiki protocol. Internal markdown never ships.
Claim law
Every public claim on a page must carry a receipt the maintaining agent verified itself that session. Uncheckable numbers do not ship. Public audit trail: /receipts/.
Runtime-Error Aggregation Contract
The lane publishes the following contract so a visitor can read the exact rules the cross-page runtime-error inspector on /colophon/#error-state is bound by, and so any future drift between the published contract and the inspector's behavior is caught by the lane's own CI before it ships. The contract is enforced by bash scripts/verify-claims.sh check #23 (this paragraph + the 5 numbered assertions + the 8-route list) on every deploy; check #22 (P55 inspector fixture harness 23/23 PASS) and the scripts/check-error-watcher-mirror.py byte-diff guard are the inspector-side enforcement wedge. The P55 inspector chrome itself is the visitor-pinned probe; this section is the published contract the probe is bound by.
- On a clean audit run, every shipped chrome route MUST classify as
CLEAN. The P55 cross-page runtime-error inspector on /colophon/#error-state classifies each audited route into exactly one of the eight public verdictsCLEAN,JS_ERROR,UNHANDLED_REJECTION,PARSE_ERROR,BUNDLE_INVALID,FETCH_THREW,TIMEOUT,CORS_BLOCKED.CLEANis the contract target for a clean audit run (synthetic browser + working network + no instrumented fault injection). A non-CLEAN verdict on a clean audit is a run-scoped contract finding — it requires lane investigation, but it is NOT a universal uptime guarantee and NOT a promise that every visitor under every network condition will see zero errors. The enum is frozen at exactly these 8 labels; no new label is added without an amendment to this section. - The contract is enforced on every deploy.
bash scripts/verify-claims.shcheck #22 must report the P55 runtime error-state inspector wired on /colophon/#error-state with all 8 public verdicts reachable and 23/23 fixture cases PASS;python3 scripts/verify-error-watcher.pymust reportOKwith the 4-invariant gate (source = iframe.contentWindow, origin = "null", run = expectedRunToken, route_id = expectedRoute) and the 2/2 sentinels (__HOOL_P55_RUN_TOKEN__,__HOOL_P55_ROUTE_ID__) present;python3 scripts/check-error-watcher-mirror.pymust report both mirrors byte-identical todata/error-watcher.js+data/error-watcher-validate.js; and check #23 (this contract) must report the 5 numbered assertions + 8-route list present in /colophon/#claim-law. - The contract's authoritative source-of-truth is the canonical mirror block on this page. The validator mirror is the verbatim
P55_VALIDATE_BEGIN...P55_VALIDATE_ENDmarker-bracketed block in /colophon/#error-state anddata/error-watcher-validate.js; the bridge mirror is the verbatimHOOL_P55_BRIDGE_SOURCE = \`...\`;template literal in /colophon/#error-state anddata/error-watcher.js. Both files are kept byte-identical to their inline mirrors byscripts/check-error-watcher-mirror.py; drift between the page and the canonical files is a contract violation that blocks the deploy. - The 8 chrome routes audited are exactly the routes enumerated by the P55 preset button.
/,/portrait/,/about/,/start/,/stats/,/now/,/colophon/,/fingerprint/. Adding or removing a route from this list requires an amendment to assertion (1), assertion (2), and theHOOL_P55_ROUTESarray in /colophon/#error-state + the published list inside this assertion — all three are kept in lockstep by the same check #22 + check #23 pair. (No parallel routes array lives inscripts/verify-error-watcher.py; the route list is the inlineHOOL_P55_ROUTESarray in the colophon's<script type="module">block, the parallelscripts/test-error-watcher-fixtures.jsharness fixtures, and this published list.) - Any future contract drift is blocked at the pre-deploy claim-drift gate; the post-deploy Guardian check is advisory. The lane's actual enforcement wedge for the published contract is
bash scripts/verify-claims.shrun bydeploy.shas a blocking pre-deploy claim-drift gate (deploy.sh exits 1 if verify-claims.sh returns non-zero — the check is wired so a non-zero exit cannot be piped away; added 2026-07-23 after a shell pipeline swallowed a stale-claim check). The Portfolio Guardian post-deploy check at deploy.sh is advisory only — it surfaces live findings (e.g. cache-lag issues, edge-transform drift) for review but does NOT auto-pause, does NOT auto-rollback, and does NOT block a deploy that has already shipped; a Guardian non-zero exit on a live URL is logged and ignored. A live non-CLEAN P55 verdict surfaced against a SHIPPED route is therefore a run-scoped contract finding that requires investigation: the lane investigates, and only a confirmed product defect (not a transient cache / network / instrumented-fault finding) requires a fix in a follow-on deploy. A drift between this contract, the inline mirrors, or the canonical data/ files is caught pre-deploy by check #22 + check #23 (blocking) and the check-mirror byte-diff (blocking); the post-deploy Guardian check reports it but does not stop the ship.
Audit a claim contract's temporal validity
A claim contract can be correct as written and still go stale — the world can change around it (a vendor replaces a library, a contract moves, a measurement rule is amended). The lane re-audits colophon claims on a category-aware cadence: foundation never-expires, contract 180d, measurement 90d, security 365d, route 90d, fallback 90d. Paste one claim per line as category: text, enter the date the contract was last written-back, and the inspector renders PASS · AGING · STALE · NEVER per claim. ~150 lines of hand-rolled JS — read the source below; no library to trust, no third party in the loop.
| Status | Category | Shelf (d) | Age (d) | Claim |
|---|
Verification
The brand promise, named: if this site says it, you can check it. "Verified" is not a vibe — it is a method with three concrete handles you can reach without trusting us.
- Receipt permalinks
- Every dated claim on hool.dev points to a SHA-stable permalink in /receipts/. The ledger is append-only: corrections land as new entries, never by mutating a published one. Example — the book-funnel truth-sync receipt shows the method on a real dated correction.
- Claim→receipt deep links
- On /work/ and /about/, every numbered fact is a link to its verifying receipt. If the chip's permalink returns non-200, the claim is not in service — it is a defect, not a contradiction.
- Local verifier
- The repo ships
scripts/verify-claims.shandscripts/verify-colophon.py. Cloning the repository and running them reproduces every check this annex depends on. Exit 0 means the contract holds; non-zero means drift, and the operator fixes before deploying. A live, dated md5 map of every route and asset ships at /fingerprint/ for the machine-friendly version of the same data. The /llms-full.txt bundle is the machine-readable text dump of every public page on this site — companion to the curated /llms.txt fact-sheet; deterministic rebuild viascripts/gen-llms-full.py. - Receipt SHA-256 drift-check
-
The first three handles on this dl are claims. Paste a
/receipts/YYYY-MM-DD-slug/URL below (or pick one of three presets) — the inspector fetches that page in your browser, computes its actual SHA-256 body hash, compares against the<meta name="receipt-sha256">tag wired by the build at deploy time, and reports whether the page you're looking at is byte-identical to the snapshot the page claims. Sibling of the network inspectors above; nothing leaves your browser exceptfetch()to the URL you paste.Presets:Awaiting URL.URL Advertised SHA-256 Computed SHA-256 Ledger Verdict What the three drift dimensions check (read the source: ~120 lines of hand-rolled JS below in this page)
- Advertised vs computed SHA-256
- The receipt permalink emits a literal
<meta name="receipt-sha256" content="…">tag wired at deploy time byscripts/verify-permalink-sha256.py. The inspector fetches the page in your browser, computes the actual SHA-256 of the response body bytes viacrypto.subtle.digest('SHA-256', bodyBytes), and compares. MATCH = the bytes you're looking at match the bytes the build-time meta claimed. MISMATCH = either the page was re-deployed without regenerating the meta, the snapshot was hand-edited, or an intermediate proxy is rewriting bytes — all three are defects. - URL present in /receipts/ ledger
- The inspector also fetches
/receipts/(same-origin, CORS-friendly) and scans its<a class="permalink" href="…">anchors for the visitor-pasted URL. MATCH = the permalink is published in the append-only ledger. MISMATCH = the URL is a 404 or was never linked from the canonical ledger — orphan, not a verified claim. - Ledger entry SHA-256 vs advertised meta
- If the URL is in the ledger, the inspector parses the surrounding ledger-entry text for an embedded
sha256: <hash>annotation (regex/sha256:\s*([0-9a-f]{64})/i) and compares against the advertised<meta>. MATCH = the ledger echoes the meta. MISMATCH = the ledger entry drifted from the meta the page itself advertises — invariant violation, operator fixes before deploy.
How a stranger checks us, end-to-end: open /receipts/ for the dated audit ledger, or /changelog/ for the dated shipping record. Pick any entry, follow the embedded permalink to its source-of-truth surface (a live URL, a registry record, or a git commit). If you find a claim on the site that does not point at a receipt, that is a defect — tell John (/about/ has the address and the disambiguation note).
Meta coverage
Every chrome route advertises a fixed set of <meta> tags — viewport, charset, description, og:title/description/url/image, twitter:card/title/description, robots. The inspector below fetches the 7 core chrome routes in parallel, parses each response's <head> via DOMParser, and verifies each required <meta> tag is present, non-empty, and unique. The required-tag spec lives in data/required-meta.json (single source of truth, bundled into this page at deploy time by scripts/bundle-required-meta.py and injected inline via scripts/inject-required-meta-inline.py); its SHA-256 is advertised in this page's <meta name="required-meta-sha256"> tag.
Click Audit the 7 core chrome routes to verify every required meta tag is present + non-empty + unique on each route. The inspector reports COMPLETE per page when all required tags pass, or flags MISSING_META / DUPLICATE_META / EMPTY_META / FETCH_DOWN. Anything beyond the required spec is listed as EXTRA_META (informational, not a verdict). Nothing leaves your browser except fetch() to the URLs in the preset.
Ready.
| Page | Required | Present | Missing / Duplicates / Empty / Extra | Verdict |
|---|---|---|---|---|
| No audit run yet. Click Audit the 7 core chrome routes. | ||||
Link-rot
Every link hool.dev ships should reach the page it claims to reach — no silent path-redirects, no missing internal anchors, no orphan external resources. The inspector below fetches a URL the visitor picks, walks every <a href> + <link href> on the response DOM, and classifies each as PASS / REDIRECTED / FAIL_4XX / FAIL_5XX / NET_ERR / TIMEOUT / CORS_BLOCKED (with ANCHOR_OK / ANCHOR_MISSING for #anchor links). External hosts are cross-referenced against data/external-resources.json so a known-allow-listed external 4XX (e.g. an external CDN reference John has pre-approved as advisory-only) does not false-positive.
Click Audit hool.dev's link graph to walk the apex's outbound links. Paste any other hool.dev URL (or external URL) to audit that page's link graph. The inspector reports per-link verdicts + an aggregate banner. Nothing leaves your browser except fetch() to the URL you paste + each outbound link on its response DOM.
Ready.
| # | URL | Kind | Verdict | Detail |
|---|---|---|---|---|
| No audit run yet. Click Audit hool.dev's link graph. | ||||
Token-drift
The Palette & contrast section above declares the design-system contract verbatim — :root sets --bg:#060708, --fg:#e9e4da, --acc:#b4ff2a, --line:#23262b, plus seven siblings, with the same tokens re-mapped in the prefers-color-scheme: light override for paper — and asserts that every chrome route publishes the same palette. The inspector below fetches the 8 core chrome routes in parallel, parses each response's :root + :root[data-theme=day] / @media (prefers-color-scheme: light) :root blocks via DOMParser, extracts every --token: value pair, and cross-checks each value against the canonical data/design-tokens.json spec (mechanically derived from the colophon's own :root at deploy time, bundled into this page at deploy time by scripts/bundle-design-tokens.py and injected inline via scripts/inject-design-tokens-inline.py; drift-guarded by scripts/verify-design-tokens-bundle.py + verify-claims.sh check #20). Verdicts: MATCH (the route's tokens are byte-identical to the canonical spec for both schemes), BG_FG_PAIR (the route uses a different token vocabulary but its night bg/fg pair is at least 4.5:1 contrast against the canonical pair — applies to the serif-led /about/ / /stats/ / /now/ / /fingerprint/ chrome), or DRIFT (a literal token mismatch on a strict route, or a sub-4.5:1 bg/fg pair on a bg-fg-pair route).
Click Audit the 8 core chrome routes to fetch every chrome route, extract every --token: value pair from its :root + light override, and verify each value against the bundled spec. The inspector reports MATCH / BG_FG_PAIR / DRIFT per route per scheme, plus a per-token diff column. Nothing leaves your browser except fetch() to the URLs in the preset.
Ready.
| Route | Scheme | Tokens audited | Diff (canonical → actual) | Verdict |
|---|---|---|---|---|
| No audit run yet. Click Audit the 8 core chrome routes. | ||||
Error-state
Every chrome route ships its own JS — / has the terminal, /portrait/ has the terminal clone, /about/ has the read-more panel, /start/ has the route scripts, /stats/ has the chart panel, /now/ has the eyebrow auditor, /colophon/ has the four prior inspectors + this one, and /fingerprint/ has its inline script — and any runtime failure (a CDN bundle that 404s, a CSP violation, an unhandled promise rejection from a stale inline bundle, a DOMParser parse error in one of the four prior inspectors, an aborted fetch) silently surfaces as a 0-line "no audit run yet" or a banner that never appears. The inspector below closes that wedge: it fetches each of the 8 same-origin chrome routes in parallel, prepends <base href=absolute-route-url> + a tiny bridge script that listens for error and unhandledrejection, srcdoc-loads the result inside a sandbox="allow-scripts" iframe (origin = opaque "null"), and verifies each trusted postMessage against four invariants: (a) event.source === iframe.contentWindow, (b) event.data.run matches the per-audit run token, (c) event.data.route_id matches the canonical route id, and (d) event.origin === "null". Forged messages are dropped before they reach the bucket counter. The 8 verdict buckets are CLEAN (no error / rejection / parse / json / fetch failure was triggered on this route — the baseline state), JS_ERROR (a trusted child bridge error postMessage — also the bucket where resource load failures and CSP violations collapse, since both surface as window.error in the sandbox), UNHANDLED_REJECTION (a trusted child bridge rejection postMessage), PARSE_ERROR (DOMParser.parseFromString on the fetched route's body returned a <parsererror> document), BUNDLE_INVALID (one of the route's inline <script type="application/json"> blocks failed JSON.parse), FETCH_THREW (the parent's own fetch() promise rejected for a non-CORS reason), TIMEOUT (the parent's AbortSignal.timeout() fired before the fetch resolved), and CORS_BLOCKED (a fetch() TypeError whose message matches /CORS|opaque|cross-origin|failed to fetch/i). Resource / CSP / iframe-runtime detail is supplemental — surfaced as the table's "Detail" column — and never replaces the public 8-enum taxonomy.
Click Audit the 8 core chrome routes to fetch each route, srcdoc-instrument it, sandbox-load it, and bucket every error + unhandledrejection it raises. The inspector accepts only trusted postMessages whose event.source, event.data.run, event.data.route_id, and event.origin all pass validation. Nothing leaves your browser except fetch() to the URLs in the preset.
Ready.
| Route | Kind | Detail | Verdict |
|---|---|---|---|
| No audit run yet. Click Audit the 8 core chrome routes. | |||
Inspector availability manifest
The site publishes 18 chrome inspectors across 5 chrome routes (this page alone mounts 7 of them — contrast-audit, error-state, inspector-manifest, link-rot, meta-coverage, sec-b-age-audit, token-drift). The inspector-availability manifest names every inspector, the route it lives on, and the exact DOM marker a visitor can probe to prove the chrome is mounted (id="..." for the section + script + button + input + meta). Click below to fetch each route, sandbox-load it inside an allow-scripts-only iframe, and verify every mount marker named in data/inspector-manifest-spec.json is present in the rendered DOM.
Sister inspector to the runtime error-state inspector (P55): same fetch + srcdoc + iframe-sandbox pattern, same banner/verdict-table vocabulary, but the verdict here is a present/absent probe against an 18-marker list rather than an 8-bucket error classifier. Both feed the brand promise — "if the site says it, you can check it" — so a missing inspector on a route is a P0: the visitor-facing receipt is no longer self-validating.
| Route | Inspector | Marker kind | Verdict |
|---|---|---|---|
| No audit run yet. Click Audit all 18 inspectors across 5 routes. | |||
Inspector versions
The site ships 202 chrome inspectors across the public routes (each codename P<n>). P65 audits each inspector's provenance: when it shipped, whether the inspector-manifest spec carries it, whether the cycle-index has its row, and whether the bundle is fresh. Five per-inspector verdicts land in the table — CURRENT (everything in sync), BUNDLE_STALE (chrome modified after the bundle or bundle older than 168h), SPEC_STALE (manifest spec does not carry this inspector at the named (page, section_id) — backfill data/inspector-manifest-spec.json), CYCLE_INDEX_DRIFT (cycle-index row does not carry this inspector — rerun scripts/gen-cycle-index.py), MISSING_REGISTRY (row dropped from the registry). Click below to fetch all 4 source bundles in parallel and compute verdicts in one pass.
| # | Inspector | Wedge | Page | Section | First shipped | SHA-7 | Verdict | Reason |
|---|