PROVEN
Raw actor-id boundary
Closes: a raw sov:/human: id — whose slug IS the human's callsign — reaching a machine surface.
The organism · its privacy architecture, proven
The rules by which I decide what to show you.
All 23 privacy boundaries proven active — just now, live — and every one of the 53 exports of the 3 dedicated boundary modules carries a declared role, with 78 exports of the wider 7 general-purpose modules outside that proof and named below. The most recurring leak in this organism's history is a privacy boundary that exists in code but is left unbound at one machine surface — invisible until an audit walks it. This page turns that audit into a living account: it lists every boundary it enforces and re-proves each one right now, by running the real redactor on a synthetic probe. A boundary reads active only when the redaction just happened — so if one ever regresses, it shows here as a gap, out loud, before it becomes a leak.
23/23privacy boundaries proven active, live
PROVEN
Obelisk denial-receipt boundary
Closes: a crossing actor's raw sov:/human: id on the machine ledger an agent polls to AUDIT the organism (the 9th carrier).
PROVEN
Held-spam signal boundary
Closes: a gate-rejected or quarantined spam signal's free-typed name + body reaching the Record.
PROVEN
Contribution feed boundary
Closes: a signed-in Sovereign's raw id + held-spam contributions on the polled machine feed.
PROVEN
Whisper archive boundary
Closes: a Steward-eyes-only whisper event crossing a public timeline.
PROVEN
Whisper receipt boundary
Closes: a whisper signal's Steward note copied onto its public receipt.
PROVEN
Confluence slug boundary
Closes: two conveners' crossing callsigns (bare slugRoots) deanonymized on a confluence surface.
PROVEN
Shared-cache audience boundary
Closes: one Sovereign's personalized page or proof card being stored by a SHARED cache under an actor-free URL and replayed to every later caller — the 12th carrier, and the first in the AUDIENCE dimension rather than the contents one.
PROVEN
Credential hand-off boundary
Closes: a shared cache storing the response that MINTS a Sovereign Key and replaying that credential to the next caller. This one is a CLASS bound on a LATENT instance and says so: all six sites are 303s, which RFC 9111 omits from the heuristically-cacheable statuses, so nothing was being stored. That was a status-code accident rather than a boundary — the first cookie-setting 200 would have put a Sovereign Key into a shared cache.
PROVEN
Connection boundary
Closes: the first request of a visit — a typed address, an http:// link, a QR code — leaving the browser in cleartext where an on-path attacker can answer the redirect themselves and proxy the site. Every other boundary here governs what a response CONTAINS or who may RECEIVE it; this one governs the pipe they all travel through, and it was the only one never declared.
PROVEN
Request-provenance boundary
Closes: a forged cross-site request MAKING the organism mint a Sovereign Key into a victim's browser — login-CSRF / session fixation. The three sibling rows above reason about the RESPONSE (who receives it, what it hands back, the pipe it travels); this is the one that reads the REQUEST: did this exchange originate here? A body leak spends an identifier and a Set-Cookie leak spends a credential — but a forged request spends the WHOLE session, binding the victim's browser to the attacker's identity so every act they take is recorded as the attacker's.
PROVEN
Navigation-capability boundary
Closes: a path-shaped value whose backslash becomes a browser authority, turning a local redirect into an off-origin navigation capability.
PROVEN
Failure-projection boundary
Closes: a payment provider's or a runtime's own words travelling out under the organism's name. Every row above governs a SUCCESS projection — a value VEILOS wrote and then chose to publish. A failure answers with text VEILOS did NOT write, so no projector had ever been applied to it: Stripe's "No such customer: cus_…" reached an unauthenticated visitor as the receipt code, because normalizeMutationReason SHAPED the value without ever BOUNDING it.
PROVEN
Identity-addressing boundary (capability monotonicity)
Closes: the public tag reversing into the raw sov: id. Every row above asks what a projection may CONTAIN; this one asks what it may HAND BACK relative to what it was GIVEN. S228 made travelling proof cards address a Sovereign by tag precisely so the callsign-bearing id would stop riding along — and the page those cards point at published that id anyway, so one weak address bought the strongest one and the anonymity promise held in the H1 while breaking one element below it.
PROVEN
Anonymity-set cardinality boundary
Closes: a Sovereign being named by ARITHMETIC rather than by a field. Every row above governs what a projection may SAY about a person; this one governs how many people a redaction has to hide among. `commonsGraph` labelled every un-opted-in convener "a Sovereign" and published the population total in the same object — and a reader can count the NAMED ends by eye but never the anonymous ones, so one subtraction gives k. At k = 1 the placeholder is a unique designator: every "a Sovereign" on the page is provably the same individual and their whole convergence neighbourhood links into one profile, with the projection itself supplying the proof of uniqueness.
PROVEN
Actor-keyed score-map boundary
Closes: an actor-KEYED map whose KEYS are the leak — the S211 invariant's original shape, uncensused until now.
PROVEN
Identity-cohort boundary
Closes: a cohort LABEL — which is its highest-weight member's raw id — and every member id, on the unauthenticated machine twin of a surface the HTML dashboard bound in S224.
PROVEN
Federated-cohort boundary
Closes: the same cohort leak arriving over the Ark, where the composite `<origin_repo>:<raw node>` KEY does not even match the value redactor's anchor.
PROVEN
Cohort-amplification boundary
Closes: a resonance map keyed by the raw node — which here INCLUDES free-typed Exchange names, so the sov:/human: value pattern alone would sail past it — plus each entry's raw cohort label.
PROVEN
Equity-distribution boundary
Closes: the top holder's raw id and every distribution row's initiate_id on the surface that publishes who the civilization's money belongs to.
PROVEN
Civilization-vitals boundary
Closes: the wallet block's raw top-holder id on the vitals payload. Its claim — that ONE projector serves both /api/equity and /api/vitals rather than a second, differently-wrong one — is what this probe proves, rather than leaving the delegation to be trusted.
PROVEN
Quarantine-record boundary
Closes: a quarantined actor's raw id on the public read side. The WRITE side classifies these events restricted/sovereign; the read side must not out-publish the write side's own classification.
PROVEN
Living-presence roster boundary
Closes: the roster's raw `actor` field on a surface served UNAUTHENTICATED to any caller and to every MCP agent. presence.mjs keeps internal truth real by design, so the whole promise rests on this projector.
What this census is counting out of
A count of boundaries proves nothing about the boundaries it never listed. So the total above is checked against the organism's actual code: every one of the 53 names exported by its dedicated boundary modules — privacyBoundary · signalBoundary · failureBoundary — must carry a declared role, and all of them do. 23 are the authority of a boundary proven above; the rest are components of one, frozen vocabulary, or resolvers that answer a question about a boundary without projecting through it.
The list of names comes from the modules themselves, not from a list kept beside them, so an export that appears cannot hide by going unlisted — and a declaration naming an export that no longer exists is just as loud.
The honest limit, counted. Of the 140 exports across the 10 modules this inventory registers, 62 carry a declared role and 78 (55.7%) do not — the non-declared exports of the 7 general-purpose modules, which are checked only at the names they were registered under. Requiring a privacy role for every export of a general-purpose module would drown the declaration in not_a_boundary rows, or invite exactly the rubber stamp this declaration exists to prevent — so the scope stays narrow and the number stays published.
Below that sits the tier this page did not previously name at all: 228 modules live in src/worker and src/observatory and 10 are registered here, leaving 218 this inventory has never put the question to. That is not a finding that they are clean — it is the statement that they were not asked, which is the only claim about them this page is entitled to make.
The ceiling on the public address
Every Sovereign's public address is four hexadecimal characters — 65536 possible addresses in total. When two inhabitants share one, VEILOS refuses to guess which of them you meant, so a proof card that has already travelled stops resolving. That refusal is correct, and it is why this number is published before it matters rather than after.
3 inhabitants · 3 distinct addresses · no address is currently shared.
Why prove them live
A privacy boundary that exists in code but is unbound at one projector is the organism's single most recurring leak. This census re-proves each boundary live by running its real predicate on a synthetic probe: a boundary reads `active` only when the redaction just happened, so a regression surfaces here — publicly, out loud — before it becomes a leak.
every probe is a synthetic literal; no real actor id, name, or body is read or shown — the census proves each boundary WITHOUT exercising it on anyone real
Machine census (JSON) → · The Failure Census → · The Abstention Ledger → · The Promises Ledger → · The Recovery Covenant →