Wiki · Evidence & Verdicts
Production-readiness sweep → GO (2026-07-16)
[redacted: category] — 1 internal hostname. Nothing else was altered. The document is otherwise exactly as it is written in the repository, and the sha256 below is of the original, so what was ingested stays checkable.How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
Eighty-seven dated pages: receipts, pre-registrations, handoffs, validation records and review verdicts. A receipt is written at the moment a piece of work was checked. It names what was claimed, the commit and the seed, what was actually run, and the outcome in one of a small set of controlled words. Then it names what the work did not achieve. That last part is what makes it a receipt rather than an announcement. A pre-registration is the same discipline run in advance: the conditions that would count as a pass and the conditions that would falsify the claim are written down before the run, so neither can be adjusted once the numbers arrive.
That is why so many small dated stubs are an audit trail rather than noise. No one of them is meant to be a good read. The value is in the sequence and in the dates, because you can watch a prediction be registered, then the run happen, then the verdict land — sometimes against the prediction. Pages here record a falsified result, a rejected fix, a retracted overclaim, and a green receipt that turned out not to be reproducible from the commit that carried it. A record that carried only successes would be worth a good deal less than this one.
A gentle way in is to read a pre-registration first, so the shape becomes familiar, then a result page, then one of the corrections. This section sits off the main navigation on purpose: it is the record you check the rest of the site against, not the place to begin.
What it is not: documentation, and not a summary. Nothing here has been tidied in hindsight. Every entry reads as of its date, a later entry may overturn an earlier one, and the presence of a page is not a claim that its result stood.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
verdict: PASS evidence_class: B gates:
- broadcast-test-stages-honest
- status-endpoint-honest
- gaia-probe-not-envelope
Production-readiness sweep → GO (2026-07-16)
Why
Operator: "what is left, sweep all and push to full production ready status, we need to go live with a broadcast test and then stay live for a while."
A 43-agent adversarial sweep (7 audit dimensions → per-finding refutation → synthesis; 3.1M tokens, 482 tool calls) over every go-live dimension: the gate ledger, the egress chain, the broadcast test, the picture, the sustained run, the honesty of every studio surface, and the recorded residuals. 28 findings confirmed, 7 refuted, 1 blocker.
THE VERDICT: GO — and the only blocker is the operator's, not the code's
The streaming endpoint store is empty (hasStore:false, hasPin:false, armed:false, fanout:0).
Stage 4 closes PASS only on readers >= 1, measured live. No keys → no pushers → no readers →
the test fails honestly. That is the design working (NEVER PRIVATE, owner directive 2026-07-14),
not a defect, and no agent may clear it (G-PA — an agent must never handle a stream key).
Agent-fixable blockers: NONE. No code change was required to run the test.
But the test would have LIED — and that is what this sweep actually bought
Four defects, all pointing the same way: green regardless of what went out.
| # | Defect | Reality |
|---|---|---|
| 1 | command_center.cjs:577 btCloseStage(3, "PASS") |
Stage 3 (SEEN SWEEP) is the test's only picture stage and its verdict was a hardcoded literal. Its per-scene rows already computed pass/fail — the stage threw them away. Every scene could render pure black and btState.go (:626 = every stage PASS) still went true. A stage that cannot fail is not a test. |
| 2 | :573 bytes > 2600 |
THE discredited byte-count (operator, 2026-07-15: "you still prefer to not finish your work and lie about the outcome"). A 480×270 q55 JPEG of a black frame clears 2600 bytes easily. It measured that OBS answered, not that anything rendered. |
| 3 | :594 |
Same byte-count for cameras. |
| 4 | :623 btCloseStage(5, "PASS") |
Park hardcoded. The restore path emitted status:"pass" without checking cutProgram's result; a real StopStream fail was overwritten by the literal. |
The honest pixel classifier (probeRenderFrac / RENDER_MIN_FRAC, :455-482) already existed 90
lines above, tested and in use by the heartbeat. The test simply never called it.
All fixed. Stage 3/5 verdicts now derive from their own rows; both picture checks use pixel truth
and fail closed (frac == null ⇒ NOT rendering — "can't verify" is never "fine"); stage 4 samples
readers twice, 6s apart and FAILs on instability, naming a platform-rejected key as the usual cause.
One defect class, three instances, one day
/api/status, /infra, and the HUD all aimed a short timeout at Gaia's ~20s / 611KB envelope
(every seat route computes it in full before filtering, gaia_server.cjs:150):
| Consumer | Timeout | Result |
|---|---|---|
HUD service gaia_drift |
8000ms | Timed out on every poll since it was added; drift rows: 0, forever |
launcher.cjs /api/status |
3000ms | gaia_up permanently false, gaia_gate permanently "unreachable" |
infra_registry.json gaia probe |
none ⇒ ` |
All three fixed. The rule, now recorded in the registry itself: never aim a probe at Gaia's
envelope. Probe liveness cheaply (/api/gaia/snapshots = 5ms, computes no envelope); read her
verdict from her own gate (verify_gaia.cjs), never infer it from a timeout.
This is a sustained-run finding, not a cosmetic one. Hours of a permanently-red panel train the operator's eye to ignore it, so a real Gaia outage becomes invisible — the same lesson the chip-address work recorded when 10 rows sat at DRIFT for a day and nobody read them. An alarm that is always on is not an alarm. Bonus: probing the envelope forced a full collector run on every poll — the probe was itself a load generator.
Also fixed: /api/status advertised a URL that is both unreachable and a 404
hud_url: "http://[redacted: internal-hostname]:8100/hud" — :8100 binds loopback (the name does resolve,
to .196, so it looks reachable and is not — a claim docs/HUD.md had already retired), and
GET /hud is a 404 (the native rewrite deleted the page). Replaced with hud_surface + hud_api.
What the adversarial layer REFUTED (7) — the sweep's own errors, caught
Worth recording, because a sweep that never refutes itself is not adversarial:
- "A cc restart orphans the ffmpeg fan-out; duplicate pushers hit one key." REFUTED, and
inverted. The claim reasoned from POSIX intuition. On Windows, libuv assigns every non-detached
child to a job object with
KILL_ON_JOB_CLOSE— the children die with the parent.detached: trueis what opts out. The proposed fix would have created the bug it claimed to cure. - "
broadcast-test-onair-completesPENDING blocks go-live." Circular — that gate is PENDING because the test hasn't run. It is a ledger record, not an interlock; nothing reads it. - "node2's relay is NOT VERIFIED." Misread the gate (it probes node2-local loopback), and node2 is off the critical path anyway per ADR-PROD-014.
- "systray_watchdog is the only supervisor." Superseded —
door_healer.cjs(2026-07-15) covers the same three surfaces.
Honest residuals — NOT claimed
- Platform acceptance is NOT VERIFIED and cannot be by this test. It measures local MediaMTX readers. It does not read back that YouTube/Twitch accepted the push. The row now says so verbatim instead of printing "PUBLIC EGRESS LIVE". Confirm public air on the platform dashboard.
- A 4-hour run is NOT underwritten. Black-picture risk via OBS WGC window-capture is HIGH and
unmitigated — detection exists, remediation does not;
cam_bridge.cjs(the scoped durable fix) is not built. A mid-run black-stick has no automatic recovery. Attend the run. - A cc crash silently drops all public air (correct fail-closed behavior — re-ARM needs the operator's PIN). An unattended 4h run is therefore not currently possible across a cc crash. Do not "fix" this by persisting the passphrase.
verify_colony.cjsFAILs (RCON not LAN-published — structural). Socolony_count=6has one source and zero independent corroboration; LAB_PROTOCOL requires two. This blocks no broadcast (the colony is a picture, not a claim) but hard-blocks any on-air statement of colony count or life. Do not say "six UNIs are alive" on air.colony_on_programfence is display-only —forage-pureworld-graduationis PENDING and the fence is live-BLOCKED, but no code enforces it and the test cuts COLONY to program. The operator must rule which reading binds before the cut.- OVERLOOK's render state is NOT VERIFIED — the health board reports it green from input
existence and mislabels it a browser source when it is
window_capture. - No soak gate exists.
studio-soak-4hshould be pre-registered before any sustained run, as a harness-managed collector (LAB_PROTOCOL: must survive compaction), not an LLM session. - G-STOP has never been human-fired. Worth 60 seconds of rehearsal before a public run.
logs/mediamtx.out.logis 40MB growing ~2.9MB/h — an RTSP retry storm from 8 unpublished cam sources reconnecting every 2s. Not a disk risk (~11MB over 4h); it drowns the signal you'd need to diagnose a real mid-run failure. Left alone rather than truncated under a live process.
Fence
viewer/command_center.cjs (test stages only) + viewer/launcher.cjs + viewer/infra_registry.json
docs/**+evidence/gates.ndjson. Nolib/sp/**, no science gate set, noCONFIRMtyped, no stream key handled or logged.:8100unchanged. Nothing was actuated: no bring-up, no go-live, no broadcast test run by the agent.
sha256 06b0e2d692dd5d23 — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
A readiness sweep that ends in a go, with the one remaining blocker belonging to the operator rather than to the code, because no agent may handle a stream key. But the finding worth reading is that the broadcast test would have passed no matter what went out. Two of its stages had their verdicts written in as literals, and its picture checks measured only that something answered rather than that anything rendered. All four are fixed to derive from real measurements and to fail when they cannot tell. The residuals are listed as explicitly not claimed, among them platform acceptance, which this test cannot check at all.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 06b0e2d692dd5d23
Clear — written for this website, not the source document
A large adversarial sweep across every dimension of going live, ending in a go verdict, with counts of how many findings were confirmed and how many the sweep refuted against itself.
The remaining blocker is described as the design working rather than as a defect. The store of streaming keys is empty, so nothing pushes, so a stage that closes only on a live measurement fails honestly, and no agent may clear it, because an agent must never handle a key.
The section that matters most is about the test having been able to lie. Four defects all point the same way: green regardless of what actually went out. One stage computed its per-scene results and then threw them away in favour of a hard-coded pass, which the page summarises in a single line, that a stage which cannot fail is not a test. Two picture checks used a byte-count threshold that a compressed black frame clears easily, so they measured that something answered rather than that anything rendered. A final stage was hard-coded too, overwriting a real failure. The sting is that an honest pixel classifier already existed a few dozen lines above, tested and in use elsewhere, and the test simply never called it.
All four are fixed. Verdicts now derive from their own rows, both picture checks use pixel truth and fail closed when they cannot tell, and the reader-count stage samples twice a few seconds apart and fails on instability while naming the usual cause.
Then one defect class in three places. Three separate consumers each aimed a short timeout at an expensive response, so all three had been failing silently since they were added. All are fixed, and a rule is recorded in the registry itself: probe liveness cheaply, and read a verdict from its own check rather than inferring it from a timeout. The reasoning is behavioural rather than technical. Hours of a permanently red panel train the operator's eye to ignore it, so a real outage becomes invisible. An alarm that is always on is not an alarm. And the probe was itself generating the load it was measuring.
A section records what the sweep's own adversarial layer refuted, on the grounds that a sweep which never refutes itself is not adversarial. One refutation is inverted completely: a proposed fix would have created the bug it claimed to cure, because the reasoning came from another operating system's behaviour. Another is called circular, since the gate said to be blocking is pending precisely because the test has not run, and nothing reads it.
The honest residuals are the longest section and are explicitly not claimed. Platform acceptance cannot be checked by this test, which measures local readers, so the row now says that in plain words. A long run is not underwritten, because the black-picture risk has detection but no remedy and the durable fix is not built, so the run must be attended. A crash drops the public feed by design, and the page warns against fixing that by storing the passphrase. One count has a single source and no independent corroboration, which blocks saying it on air. One stated limit is display-only, with no code enforcing it, so the operator must rule which reading binds. And a log growing steadily is left alone rather than truncated under a live process, with the reason given.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 06b0e2d692dd5d23