HOOL / colophon
COLOPHON / STATEMENT OF RECORD

HOW HOOL.DEV IS BUILT

Static site on Cloudflare Pages. Dependencies and measurement disclosed. Deploys gated by allowlist and human word. Homepage built unattended; every public claim requires a receipt.

last regenerated 2026-09-24T17:33Z

Authority

John Whitman is the human owner and trust anchor. The site is maintained by AI agents under an append-only internal journal and reference-wiki protocol. Agents extend current truth in place; history goes in the journal. Production requires John's word. Agents do not push production without authorization. See /about/ and /now/.

last regenerated 2026-09-24T17:33Z

Release

  1. Deploys run through an allowlisting script that stages only approved file types and aborts if any internal Markdown would reach production. Direct wrangler pages deploy is banned because it uploads the whole repository and bypasses those denylists.
  2. Deploys require the human owner's word. Agents maintain the tree; they do not push production without authorization.
last regenerated 2026-09-24T17:33Z

Stack

Hosting · apex
Cloudflare Pages at hool.dev. Static site. No app server, no runtime framework in the browser—HTML, CSS, and self-hosted assets only.
Type · art
Self-hosted JetBrains Mono (SIL OFL). Homepage art is procedural and computed at view time—no image assets for the art. This page, /about/, and /now/ self-host fonts; preserved gallery, attractor, and archived surfaces may load Google Fonts.
Charts
/receipts/ vendors uPlot v1.6.31 (MIT, © Leon Sorokin 2022) at /receipts/vendor/uPlot/. Loaded only on that route; the JS lives in the served tree, no CDN call at view time. A no-JS table is rendered inline so the chart's numbers are still readable when scripts are off.
Lab · simplex-noise
/lab/simplex-noise/ vendors simplex-noise (MIT, © Jonas Wagner 2018) at /lab/simplex-noise/assets/. Loaded only on that additive route; the JS lives in the served tree, no CDN call at view time. Taste-gated; not production until the owner’s deploy word.
last regenerated 2026-09-24T17:33Z

Palette & contrast

The design system names ten CSS custom properties (above in Stack, also set in this page's :root). The brand promise — if the site says it, you can check it — extends to the palette: the visitor runs the math, not the maintainer. Below is the literal hex map and a visitor-side WCAG 2.1 contrast verifier. It honors prefers-color-scheme; the night palette is the default and the paper palette sits behind a <details>.

What the verifier computes

Relative luminance per WCAG 2.1 §2.3.1: each sRGB channel is linearized (s ≤ 0.03928 → s/12.92, else ((s+0.055)/1.055)^2.4), then L = 0.2126·R + 0.7152·G + 0.0722·B. Contrast ratio (L₁+0.05)/(L₂+0.05) where L₁ is the lighter color. Thresholds from WCAG 2.1 §1.4.3 and §1.4.11: AA normal 4.5, AA large 3.0, AAA normal 7.0, AAA large 4.5, UI components 3.0. The same math runs on every page via scripts/contrast-cli.js in CI; this is the visitor-side mirror.

Contrast ratio: —

Default is --fg on --bg (night palette) — the same pair running this page. Click any swatch's "use" button to load it into the matching slot.

last regenerated 2026-09-24T17:33Z

Network

Serving · logs
Cloudflare Pages serves the site and keeps standard edge logs.
Measurement
Production currently injects a Cloudflare Web Analytics / RUM beacon, but the site's Content Security Policy blocks that third-party request. Browser measurement may be enabled later under this disclosure.
Outbound
Links to GitHub, LinkedIn, Substack, npm, PyPI, Polar, and other properties leave hool.dev when followed. Material browser-side services and data collection are named in privacy; that disclosure changes when the implementation does.

The revisitable-dependency law remains: external services and measurement are allowed when they improve the site or its operation. The retired "zero" rule is historical, not a constraint.

Audit the HTTP response headers any site sends. Paste the output of curl -sI <url> (or your browser's response-headers pane) below; the inspector runs eight OWASP / Mozilla-grade rule checks and renders PASS · INFO · WARN · FAIL per header. Nothing leaves your browser.

JavaScript is off. The inspector needs JS to parse the headers and render the rule table. Run curl -sI https://hool.dev/ in your terminal, or visit Mozilla Observatory / SecurityHeaders.com for server-side audits.

Awaiting input.
What the eight rules check (read the source: ~120 lines of hand-rolled JS below in this page)
Content-Security-Policy
PASS if default-src (or stricter) is set and no 'unsafe-eval' or wildcard * appears in script-src. WARN if 'unsafe-inline' appears (flagged with rationale — hool.dev ships this trade-off to allow its inline critical CSS / same-origin scripts). FAIL if script-src is missing entirely, or contains 'unsafe-eval'.
Strict-Transport-Security
PASS if max-age ≥ 31,536,000 (one year) AND includeSubDomains or preload. FAIL if max-age=0 or absent.
X-Frame-Options
PASS on DENY or SAMEORIGIN. hool.dev ships SAMEORIGIN — same-origin framing of /gallery/ iframes of /attractors/* is intentional. Modern browsers prefer CSP frame-ancestors; XFO remains a defence-in-depth signal.
X-Content-Type-Options
PASS on nosniff. FAIL if absent (MIME-sniffing risk).
Referrer-Policy
PASS on strict-origin-when-cross-origin / no-referrer / same-origin / strict-origin. FAIL on unsafe-url or no-referrer-when-downgrade.
Permissions-Policy
PASS if at minimum geolocation=(), microphone=(), camera=() (or stricter) are present — these are the high-leverage features used in clickjacking / covert-recording attacks.
Cross-Origin-Opener-Policy
INFO if absent (the inspector does not penalise absence). PASS on same-origin or stricter. Required only if SharedArrayBuffer / high-resolution timers are needed.
Cross-Origin-Embedder-Policy
INFO if absent. PASS on require-corp or credentialless. Same precondition as COOP; not shipped on most static sites.

Audit the body the apex actually serves. Paste the raw body from curl -s <url> (or your browser's view source) below; the inspector computes its SHA-256 via SubtleCrypto.digest and compares against the deploy-time capture at /body-snapshot.txt. A Fetch live hool.dev body button prefills the snapshot file the lane captured at last deploy, so you can audit whether the snapshot is the bytes apex actually serves — without trusting a third party. The verdict grid also surfaces a capture-age auditor's pick (P38): the deploy-time capture's age in whole UTC days against a 90-day deployed-route shelf, with FRESH / AGING / STALE / FALSIFIED bands. A separate Refresh capture-age pick button re-runs just the age check without re-auditing the bytes. Nothing leaves your browser.

JavaScript is off. The auditor needs SubtleCrypto.digest to compute SHA-256 in-browser. Run curl -s https://hool.dev/ | shasum -a 256 in your terminal to get the same hash by hand. The /body-snapshot.txt capture is also committed to the repo so you can git show origin/main:public/body-snapshot.txt | shasum -a 256 for the deploy-time fingerprint.

Awaiting input.
What the five checks verify (read the source: ~150 lines of hand-rolled JS below)
Capture age (timestamp auditor)
P38 — fetch('/body-snapshot.txt', {method:'HEAD'}).headers.get('date') → compute age in whole UTC days against today's UTC midnight. Shelf policy: deployed-route = 90d (sibling of P22-P37 inspector family). FRESH ≤72d (green), AGING 73-90d (amber), STALE >90d (red, past shelf), FALSIFIED capture date in the future (anti-tamper signal — snapshot was tampered with or its Date header rotated forward). The timestamp-auditor verdict is the single oldest stale claim this inspector can flag: if FRESH the inspector can keep its assertion ("bytes apex served today match last deploy"), if STALE the visitor knows the snapshot's capture is older than the shelf and a new deploy is due.
Content-Type parsed
Light regex pull of media-type + optional charset from the visitor-pasted header. INFO if absent — the visitor can paste one if they have it; the inspector still computes the SHA-256 regardless.
Body SHA-256 (your bytes)
SubtleCrypto.digest('SHA-256', visitorBytes) → hex. The literal JS function call is visible in the module below; no library.
Body SHA-256 (snapshot)
SubtleCrypto.digest('SHA-256', fetch('/body-snapshot.txt').then(r=>r.arrayBuffer())) → hex. Same SubtleCrypto.digest path; the snapshot bytes are the deploy-time capture from deploy.sh.
Verdict
PASS if your sha-256 == snapshot sha-256 (the bytes apex served at last deploy match what the visitor just received). FAIL on mismatch (apex changed since the deploy-time capture, or visitor fetched a different URL). INFO if only one side is available (visitor hasn't pasted yet, or snapshot fetch failed). The capture-age row is independent of this verdict — a STALE snapshot can still PASS the byte comparison (the bytes ARE the bytes apex served; they're just older than the shelf).
last regenerated 2026-09-24T17:33Z

Provenance

The homepage (THE FLOOR) was built unattended by an autonomous AI agent fleet from a single open brief on 2026-06-12, then re-audited unattended the same day: every count, status, and price re-verified against fleet receipts; stale numbers corrected; unprovable numbers removed. Previous build preserved at /gallery/. Receipts at /receipts/. The site is maintained by AI agents under the journal/wiki protocol. Internal markdown never ships.

last regenerated 2026-09-24T17:33Z

Claim law

Every public claim on a page must carry a receipt the maintaining agent verified itself that session. Uncheckable numbers do not ship. Public audit trail: /receipts/.

Runtime-Error Aggregation Contract

The lane publishes the following contract so a visitor can read the exact rules the cross-page runtime-error inspector on /colophon/#error-state is bound by, and so any future drift between the published contract and the inspector's behavior is caught by the lane's own CI before it ships. The contract is enforced by bash scripts/verify-claims.sh check #23 (this paragraph + the 5 numbered assertions + the 8-route list) on every deploy; check #22 (P55 inspector fixture harness 23/23 PASS) and the scripts/check-error-watcher-mirror.py byte-diff guard are the inspector-side enforcement wedge. The P55 inspector chrome itself is the visitor-pinned probe; this section is the published contract the probe is bound by.

  1. On a clean audit run, every shipped chrome route MUST classify as CLEAN. The P55 cross-page runtime-error inspector on /colophon/#error-state classifies each audited route into exactly one of the eight public verdicts CLEAN, JS_ERROR, UNHANDLED_REJECTION, PARSE_ERROR, BUNDLE_INVALID, FETCH_THREW, TIMEOUT, CORS_BLOCKED. CLEAN is the contract target for a clean audit run (synthetic browser + working network + no instrumented fault injection). A non-CLEAN verdict on a clean audit is a run-scoped contract finding — it requires lane investigation, but it is NOT a universal uptime guarantee and NOT a promise that every visitor under every network condition will see zero errors. The enum is frozen at exactly these 8 labels; no new label is added without an amendment to this section.
  2. The contract is enforced on every deploy. bash scripts/verify-claims.sh check #22 must report the P55 runtime error-state inspector wired on /colophon/#error-state with all 8 public verdicts reachable and 23/23 fixture cases PASS; python3 scripts/verify-error-watcher.py must report OK with the 4-invariant gate (source = iframe.contentWindow, origin = "null", run = expectedRunToken, route_id = expectedRoute) and the 2/2 sentinels (__HOOL_P55_RUN_TOKEN__, __HOOL_P55_ROUTE_ID__) present; python3 scripts/check-error-watcher-mirror.py must report both mirrors byte-identical to data/error-watcher.js + data/error-watcher-validate.js; and check #23 (this contract) must report the 5 numbered assertions + 8-route list present in /colophon/#claim-law.
  3. The contract's authoritative source-of-truth is the canonical mirror block on this page. The validator mirror is the verbatim P55_VALIDATE_BEGIN ... P55_VALIDATE_END marker-bracketed block in /colophon/#error-state and data/error-watcher-validate.js; the bridge mirror is the verbatim HOOL_P55_BRIDGE_SOURCE = \`...\`; template literal in /colophon/#error-state and data/error-watcher.js. Both files are kept byte-identical to their inline mirrors by scripts/check-error-watcher-mirror.py; drift between the page and the canonical files is a contract violation that blocks the deploy.
  4. The 8 chrome routes audited are exactly the routes enumerated by the P55 preset button. /, /portrait/, /about/, /start/, /stats/, /now/, /colophon/, /fingerprint/. Adding or removing a route from this list requires an amendment to assertion (1), assertion (2), and the HOOL_P55_ROUTES array in /colophon/#error-state + the published list inside this assertion — all three are kept in lockstep by the same check #22 + check #23 pair. (No parallel routes array lives in scripts/verify-error-watcher.py; the route list is the inline HOOL_P55_ROUTES array in the colophon's <script type="module"> block, the parallel scripts/test-error-watcher-fixtures.js harness fixtures, and this published list.)
  5. Any future contract drift is blocked at the pre-deploy claim-drift gate; the post-deploy Guardian check is advisory. The lane's actual enforcement wedge for the published contract is bash scripts/verify-claims.sh run by deploy.sh as a blocking pre-deploy claim-drift gate (deploy.sh exits 1 if verify-claims.sh returns non-zero — the check is wired so a non-zero exit cannot be piped away; added 2026-07-23 after a shell pipeline swallowed a stale-claim check). The Portfolio Guardian post-deploy check at deploy.sh is advisory only — it surfaces live findings (e.g. cache-lag issues, edge-transform drift) for review but does NOT auto-pause, does NOT auto-rollback, and does NOT block a deploy that has already shipped; a Guardian non-zero exit on a live URL is logged and ignored. A live non-CLEAN P55 verdict surfaced against a SHIPPED route is therefore a run-scoped contract finding that requires investigation: the lane investigates, and only a confirmed product defect (not a transient cache / network / instrumented-fault finding) requires a fix in a follow-on deploy. A drift between this contract, the inline mirrors, or the canonical data/ files is caught pre-deploy by check #22 + check #23 (blocking) and the check-mirror byte-diff (blocking); the post-deploy Guardian check reports it but does not stop the ship.

Audit a claim contract's temporal validity

A claim contract can be correct as written and still go stale — the world can change around it (a vendor replaces a library, a contract moves, a measurement rule is amended). The lane re-audits colophon claims on a category-aware cadence: foundation never-expires, contract 180d, measurement 90d, security 365d, route 90d, fallback 90d. Paste one claim per line as category: text, enter the date the contract was last written-back, and the inspector renders PASS · AGING · STALE · NEVER per claim. ~150 lines of hand-rolled JS — read the source below; no library to trust, no third party in the loop.

last regenerated 2026-09-24T17:33Z

Verification

The brand promise, named: if this site says it, you can check it. "Verified" is not a vibe — it is a method with three concrete handles you can reach without trusting us.

Receipt permalinks
Every dated claim on hool.dev points to a SHA-stable permalink in /receipts/. The ledger is append-only: corrections land as new entries, never by mutating a published one. Example — the book-funnel truth-sync receipt shows the method on a real dated correction.
Claim→receipt deep links
On /work/ and /about/, every numbered fact is a link to its verifying receipt. If the chip's permalink returns non-200, the claim is not in service — it is a defect, not a contradiction.
Local verifier
The repo ships scripts/verify-claims.sh and scripts/verify-colophon.py. Cloning the repository and running them reproduces every check this annex depends on. Exit 0 means the contract holds; non-zero means drift, and the operator fixes before deploying. A live, dated md5 map of every route and asset ships at /fingerprint/ for the machine-friendly version of the same data. The /llms-full.txt bundle is the machine-readable text dump of every public page on this site — companion to the curated /llms.txt fact-sheet; deterministic rebuild via scripts/gen-llms-full.py.
Receipt SHA-256 drift-check

The first three handles on this dl are claims. Paste a /receipts/YYYY-MM-DD-slug/ URL below (or pick one of three presets) — the inspector fetches that page in your browser, computes its actual SHA-256 body hash, compares against the <meta name="receipt-sha256"> tag wired by the build at deploy time, and reports whether the page you're looking at is byte-identical to the snapshot the page claims. Sibling of the network inspectors above; nothing leaves your browser except fetch() to the URL you paste.

Presets:

Awaiting URL.
URLAdvertised SHA-256Computed SHA-256LedgerVerdict
What the three drift dimensions check (read the source: ~120 lines of hand-rolled JS below in this page)
Advertised vs computed SHA-256
The receipt permalink emits a literal <meta name="receipt-sha256" content="…"> tag wired at deploy time by scripts/verify-permalink-sha256.py. The inspector fetches the page in your browser, computes the actual SHA-256 of the response body bytes via crypto.subtle.digest('SHA-256', bodyBytes), and compares. MATCH = the bytes you're looking at match the bytes the build-time meta claimed. MISMATCH = either the page was re-deployed without regenerating the meta, the snapshot was hand-edited, or an intermediate proxy is rewriting bytes — all three are defects.
URL present in /receipts/ ledger
The inspector also fetches /receipts/ (same-origin, CORS-friendly) and scans its <a class="permalink" href="…"> anchors for the visitor-pasted URL. MATCH = the permalink is published in the append-only ledger. MISMATCH = the URL is a 404 or was never linked from the canonical ledger — orphan, not a verified claim.
Ledger entry SHA-256 vs advertised meta
If the URL is in the ledger, the inspector parses the surrounding ledger-entry text for an embedded sha256: <hash> annotation (regex /sha256:\s*([0-9a-f]{64})/i) and compares against the advertised <meta>. MATCH = the ledger echoes the meta. MISMATCH = the ledger entry drifted from the meta the page itself advertises — invariant violation, operator fixes before deploy.

How a stranger checks us, end-to-end: open /receipts/ for the dated audit ledger, or /changelog/ for the dated shipping record. Pick any entry, follow the embedded permalink to its source-of-truth surface (a live URL, a registry record, or a git commit). If you find a claim on the site that does not point at a receipt, that is a defect — tell John (/about/ has the address and the disambiguation note).

last regenerated 2026-09-24T17:33Z

Meta coverage

Every chrome route advertises a fixed set of <meta> tags — viewport, charset, description, og:title/description/url/image, twitter:card/title/description, robots. The inspector below fetches the 7 core chrome routes in parallel, parses each response's <head> via DOMParser, and verifies each required <meta> tag is present, non-empty, and unique. The required-tag spec lives in data/required-meta.json (single source of truth, bundled into this page at deploy time by scripts/bundle-required-meta.py and injected inline via scripts/inject-required-meta-inline.py); its SHA-256 is advertised in this page's <meta name="required-meta-sha256"> tag.

Click Audit the 7 core chrome routes to verify every required meta tag is present + non-empty + unique on each route. The inspector reports COMPLETE per page when all required tags pass, or flags MISSING_META / DUPLICATE_META / EMPTY_META / FETCH_DOWN. Anything beyond the required spec is listed as EXTRA_META (informational, not a verdict). Nothing leaves your browser except fetch() to the URLs in the preset.

Ready.

PageRequiredPresentMissing / Duplicates / Empty / ExtraVerdict
No audit run yet. Click Audit the 7 core chrome routes.

Spec source-of-truth: data/required-meta.json — bundled into this page at deploy time. Visitor fallback to /colophon/required-meta.json for older chrome in flight at edge caches during rolling deploy. The <meta name="required-meta-sha256"> tag advertised in this page's <head> matches the SHA-256 of the on-disk spec; if a visitor's browser reports a mismatch, the spec was edited without re-bundling.

last regenerated 2026-09-24T17:33Z

Token-drift

The Palette & contrast section above declares the design-system contract verbatim — :root sets --bg:#060708, --fg:#e9e4da, --acc:#b4ff2a, --line:#23262b, plus seven siblings, with the same tokens re-mapped in the prefers-color-scheme: light override for paper — and asserts that every chrome route publishes the same palette. The inspector below fetches the 8 core chrome routes in parallel, parses each response's :root + :root[data-theme=day] / @media (prefers-color-scheme: light) :root blocks via DOMParser, extracts every --token: value pair, and cross-checks each value against the canonical data/design-tokens.json spec (mechanically derived from the colophon's own :root at deploy time, bundled into this page at deploy time by scripts/bundle-design-tokens.py and injected inline via scripts/inject-design-tokens-inline.py; drift-guarded by scripts/verify-design-tokens-bundle.py + verify-claims.sh check #20). Verdicts: MATCH (the route's tokens are byte-identical to the canonical spec for both schemes), BG_FG_PAIR (the route uses a different token vocabulary but its night bg/fg pair is at least 4.5:1 contrast against the canonical pair — applies to the serif-led /about/ / /stats/ / /now/ / /fingerprint/ chrome), or DRIFT (a literal token mismatch on a strict route, or a sub-4.5:1 bg/fg pair on a bg-fg-pair route).

Click Audit the 8 core chrome routes to fetch every chrome route, extract every --token: value pair from its :root + light override, and verify each value against the bundled spec. The inspector reports MATCH / BG_FG_PAIR / DRIFT per route per scheme, plus a per-token diff column. Nothing leaves your browser except fetch() to the URLs in the preset.

Ready.

RouteSchemeTokens auditedDiff (canonical → actual)Verdict
No audit run yet. Click Audit the 8 core chrome routes.

Spec source-of-truth: data/design-tokens.json — bundled into this page at deploy time. Visitor fallback to /colophon/design-tokens.json for older chrome in flight at edge caches during rolling deploy. The canonical page is /colophon/ itself — the colophon's OWN :root is the design-system authority. Routes that use a different token vocabulary (the serif-led /about/ / /stats/ / /now/ / /fingerprint/ chrome) are accepted if their night bg/fg pair passes a 4.5:1 contrast check against the canonical (#060708, #e9e4da) pair.

last regenerated 2026-09-24T17:33Z

Error-state

Every chrome route ships its own JS — / has the terminal, /portrait/ has the terminal clone, /about/ has the read-more panel, /start/ has the route scripts, /stats/ has the chart panel, /now/ has the eyebrow auditor, /colophon/ has the four prior inspectors + this one, and /fingerprint/ has its inline script — and any runtime failure (a CDN bundle that 404s, a CSP violation, an unhandled promise rejection from a stale inline bundle, a DOMParser parse error in one of the four prior inspectors, an aborted fetch) silently surfaces as a 0-line "no audit run yet" or a banner that never appears. The inspector below closes that wedge: it fetches each of the 8 same-origin chrome routes in parallel, prepends <base href=absolute-route-url> + a tiny bridge script that listens for error and unhandledrejection, srcdoc-loads the result inside a sandbox="allow-scripts" iframe (origin = opaque "null"), and verifies each trusted postMessage against four invariants: (a) event.source === iframe.contentWindow, (b) event.data.run matches the per-audit run token, (c) event.data.route_id matches the canonical route id, and (d) event.origin === "null". Forged messages are dropped before they reach the bucket counter. The 8 verdict buckets are CLEAN (no error / rejection / parse / json / fetch failure was triggered on this route — the baseline state), JS_ERROR (a trusted child bridge error postMessage — also the bucket where resource load failures and CSP violations collapse, since both surface as window.error in the sandbox), UNHANDLED_REJECTION (a trusted child bridge rejection postMessage), PARSE_ERROR (DOMParser.parseFromString on the fetched route's body returned a <parsererror> document), BUNDLE_INVALID (one of the route's inline <script type="application/json"> blocks failed JSON.parse), FETCH_THREW (the parent's own fetch() promise rejected for a non-CORS reason), TIMEOUT (the parent's AbortSignal.timeout() fired before the fetch resolved), and CORS_BLOCKED (a fetch() TypeError whose message matches /CORS|opaque|cross-origin|failed to fetch/i). Resource / CSP / iframe-runtime detail is supplemental — surfaced as the table's "Detail" column — and never replaces the public 8-enum taxonomy.

Click Audit the 8 core chrome routes to fetch each route, srcdoc-instrument it, sandbox-load it, and bucket every error + unhandledrejection it raises. The inspector accepts only trusted postMessages whose event.source, event.data.run, event.data.route_id, and event.origin all pass validation. Nothing leaves your browser except fetch() to the URLs in the preset.

Ready.

RouteKindDetailVerdict
No audit run yet. Click Audit the 8 core chrome routes.

Bridge source-of-truth: data/error-watcher.js (the literal snippet injected into every fetched route's srcdoc top). Validator + classifier source-of-truth: data/error-watcher-validate.js (mirrored verbatim inline below; identical bytes tested by the fixture harness). The bridge inlines the per-audit run token + route id; the parent re-validates them before any message reaches the bucket counter. Sandbox = allow-scripts only (no allow-same-origin) so the iframe's origin is the opaque "null" — it cannot read parent state, localStorage, or DOM. The 12-case runtime fixture harness in scripts/test-error-watcher-fixtures.js (run via python3 scripts/verify-error-watcher.py, asserted by verify-claims.sh check #22) loads the bridge source + the canonical validator + classifier and proves the bucket path against the 8 public verdict enums (CLEAN, JS_ERROR, UNHANDLED_REJECTION, PARSE_ERROR, BUNDLE_INVALID, FETCH_THREW, TIMEOUT, CORS_BLOCKED) plus the 4 required forged postMessage rejections (wrong source, wrong run token, wrong route id, wrong origin).

last regenerated 2026-09-24T17:33Z

Inspector availability manifest

The site publishes 18 chrome inspectors across 5 chrome routes (this page alone mounts 7 of them — contrast-audit, error-state, inspector-manifest, link-rot, meta-coverage, sec-b-age-audit, token-drift). The inspector-availability manifest names every inspector, the route it lives on, and the exact DOM marker a visitor can probe to prove the chrome is mounted (id="..." for the section + script + button + input + meta). Click below to fetch each route, sandbox-load it inside an allow-scripts-only iframe, and verify every mount marker named in data/inspector-manifest-spec.json is present in the rendered DOM.

Sister inspector to the runtime error-state inspector (P55): same fetch + srcdoc + iframe-sandbox pattern, same banner/verdict-table vocabulary, but the verdict here is a present/absent probe against an 18-marker list rather than an 8-bucket error classifier. Both feed the brand promise — "if the site says it, you can check it" — so a missing inspector on a route is a P0: the visitor-facing receipt is no longer self-validating.

Idle — click Audit all 18 inspectors across 5 routes to mount-check every inspector the site publishes.
Route Inspector Marker kind Verdict
No audit run yet. Click Audit all 18 inspectors across 5 routes.

Source-of-truth: data/inspector-manifest-spec.json (5 routes-with-inspectors + 4 narrative routes + 9 total chrome routes; 18 inspector entries). Mirrored verbatim inline below as <script type="application/json" id="inspector-manifest"> so the chrome reads the same JSON without any network fetch. The bundle is regenerated on every deploy by scripts/bundle-inspector-manifest.py and substituted into the placeholder by scripts/inject-inspector-manifest-inline.py; scripts/verify-inspector-manifest-bundle.py asserts the on-disk bundle matches data/inspector-manifest-spec.json so a stale spec blocks deploy. The 10-case fixture harness in scripts/test-inspector-manifest.py proves the bundle schema, mount invariants, and meta-availability invariant (this section must list itself). Sandbox = allow-scripts only — same opaque-origin guarantee as the P55 error-state inspector.

last regenerated 2026-09-24T17:33Z

Inspector versions

The site ships 202 chrome inspectors across the public routes (each codename P<n>). P65 audits each inspector's provenance: when it shipped, whether the inspector-manifest spec carries it, whether the cycle-index has its row, and whether the bundle is fresh. Five per-inspector verdicts land in the table — CURRENT (everything in sync), BUNDLE_STALE (chrome modified after the bundle or bundle older than 168h), SPEC_STALE (manifest spec does not carry this inspector at the named (page, section_id) — backfill data/inspector-manifest-spec.json), CYCLE_INDEX_DRIFT (cycle-index row does not carry this inspector — rerun scripts/gen-cycle-index.py), MISSING_REGISTRY (row dropped from the registry). Click below to fetch all 4 source bundles in parallel and compute verdicts in one pass.

Idle — click Audit all 202 inspector versions to provenance-check every inspector the site ships.
#InspectorWedgePageSectionFirst shippedSHA-7VerdictReason

Source-of-truth: data/__INSPECTOR_REGISTRY.json (202 inspector rows, hand-edited, mirrors every P<n> shipped across the chrome inspector family) + data/cycle-index.json (1071 cycles generated by scripts/gen-cycle-index.py walking git log origin/main --grep cycle-NNN) + data/git-log-summary.json (last 30 SHIPPED cycle commits, generated by scripts/gen-git-log-summary.py) + data/inspector-manifest-spec.json (P64 source-of-truth list of every chrome mount marker). All 4 are mirrored verbatim inline below as