The organism · its privacy architecture, proven

The rules by which I decide what to show you.

All 7 privacy boundaries proven active — just now, live. The most recurring leak in this organism's history is a privacy boundary that exists in code but is left unbound at one machine surface — invisible until an audit walks it. This page turns that audit into a living account: it lists every boundary it enforces and re-proves each one right now, by running the real redactor on a synthetic probe. A boundary reads active only when the redaction just happened — so if one ever regresses, it shows here as a gap, out loud, before it becomes a leak.

7/7privacy boundaries proven active, live

PROVEN

Raw actor-id boundary

Closes: a raw sov:/human: id — whose slug IS the human's callsign — reaching a machine surface.

redactActorFields / publicActorTag (S211 · S221)

Guards: /api/state · /api/orders · /api/quarantine · every actor-keyed projector

PROVEN

Obelisk denial-receipt boundary

Closes: a crossing actor's raw sov:/human: id on the machine ledger an agent polls to AUDIT the organism (the 9th carrier).

publicDenialReceiptView (S221 · D-S236.1)

Guards: /api/transparency · /api/quarantine · /verify/:id · /api/state denial receipts

PROVEN

Held-spam signal boundary

Closes: a gate-rejected or quarantined spam signal's free-typed name + body reaching the Record.

signalBoundary.isHeldSignal (S214)

Guards: /api/state · /api/hive/lessons · /imprint/feed.json · /collaborate · /ledger · the feeds

PROVEN

Contribution feed boundary

Closes: a signed-in Sovereign's raw id + held-spam contributions on the polled machine feed.

publicContributionFeed (S235 · D-S235.1)

Guards: /imprint/feed.json · /collaborate/feed.json

PROVEN

Whisper archive boundary

Closes: a Steward-eyes-only whisper event crossing a public timeline.

isPublicArchiveEvent (S203)

Guards: /api/state archiveEvents · the chronicle + pulse feeds

PROVEN

Whisper receipt boundary

Closes: a whisper signal's Steward note copied onto its public receipt.

publicReceiptView / isWhisperLinkedReceipt (S204)

Guards: /receipt/:id · its Atom feed · /passport · /api/state receipts

PROVEN

Confluence slug boundary

Closes: two conveners' crossing callsigns (bare slugRoots) deanonymized on a confluence surface.

redactActorFields roots/confluence_key strip (S225 · S229)

Guards: /api/state imprints + archive events · the due feed

Why prove them live

A privacy boundary that exists in code but is unbound at one projector is the organism's single most recurring leak. This census re-proves each boundary live by running its real predicate on a synthetic probe: a boundary reads `active` only when the redaction just happened, so a regression surfaces here — publicly, out loud — before it becomes a leak.

every probe is a synthetic literal; no real actor id, name, or body is read or shown — the census proves each boundary WITHOUT exercising it on anyone real

Machine census (JSON) → · The Abstention Ledger → · The Recovery Covenant →