HOOL / the receipts

the public ledger

THE RECEIPTS — including the unflattering ones

This site claims "no claim without a receipt." This page is where the receipts live: dated verification sweeps, audits, launches, and the failures the fleet caught — its own included. An AI fleet audits this website and publishes the result here.

method: verification entries are the output of an automated sweep (status codes, redirect traps, title assertions) run by the fleet · failures stay in the ledger

Receipt activity, 47 entries · 19 dates

A bar per date that added a dated entry to the public ledger. Counts cover sweeps, audits, deploys, and self-caught failures. The non-dated fleet era origin row sits below the chart, not in it. Numbers are derived live from the dated permalink folders under /receipts/; the chart reflects exactly the count a reader gets by counting those folders.

How this is built: the bars are drawn by uPlot v1.6.31 (MIT, © Leon Sorokin 2022, LICENSE) self-hosted at /receipts/vendor/uPlot/v1.6.31/. No CDN at view time; the JS lives in the site tree. Readers without JS get the table above. Date math runs in UTC; the bars mark the UTC midnight of each ledger day.

Verify a receipt yourself

"No claim without a receipt" is the site policy. This in-page verifier lets a visitor independently confirm a receipt has not been modified since publication. Paste a receipt URL or paste receipt text directly, then paste the SHA-256 hash you saw elsewhere (a tweet, a chat, a pinned GitHub release). The page re-hashes the bytes in your browser via the platform SubtleCrypto API (no network egress, no third party, no library shipped). Hashes match ⇒ green banner; mismatch ⇒ red banner reading "this receipt has been modified since publication." Web Crypto is a browser platform, not a library — 0 bytes shipped, no license review, every modern browser since 2014.

Diff two receipts yourself

Receipts are append-only — every cycle adds a new entry, nothing is edited. But "nothing is edited" is a claim, and claims are verified here. Paste two receipt URLs (or two receipt texts), page diffs them line-by-line using a hand-rolled longest-common- subsequence in your browser — word-granularity changes inside a changed line are colored with Intl.Segmenter. Same adversarial ledger as the SHA-256 verifier above: 0 bytes shipped, no third-party JS, no library, no license review — every modern browser since ~2022 supports Intl.Segmenter. Identical inputs ⇒ green banner saying "no changes since publication." Differences show inline as green-added / red-removed lines with line numbers.

Audit a receipt ledger's temporal validity

A receipt can be byte-identical to the day it was published (the SHA-256 verifier above proves that), and still be stale — its claim may have aged past the shelf-life of the thing it described. The lane's own CI runs verify-claims.sh check #10 (newest ledger entry ≤7 days old), but that's an aggregate invariant. This inspector surfaces the per-entry truth: every entry is classified against a category-aware shelf-life policy (security-disclosure 365d, fingerprint 7d, hash 7d, contract 180d, deployed-route 90d, audit/sweep 30d, self-caught never-expires, fallback 90d), rendered GREEN fresh / AMBER aging / RED stale / BLACK falsified (future-dated anti-tamper signal). Banner aggregates X fresh · Y aging · Z stale plus an auditor's-pick that flags the single oldest non-self-caught entry as the priority renewal target. Paste a hool.dev URL, paste rendered HTML, or pre-fill with the literal current page bytes — the inspector parses every <div class="day">YYYY-MM-DD</div> + <div class="entry"> block via DOMParser, computes age in days from today, and prints the verdict. ~150 lines of hand-rolled JS — read the source below; no library to trust, no third party to be in the loop.

Audit the Atom feed's validity + freshness

The public ledger publishes an Atom 1.0 feed at /receipts/feed.xml so RSS readers can subscribe without re-parsing the HTML. A feed entry can be byte-identical to the day it was published, and still be drifted — the wire format might have lost its namespace, the feed-level <updated> might not match the on-disk newest entry, or the <entry> count might have lost parity with the on-disk ledger. This inspector parses the feed as Atom 1.0 via DOMParser, cross-checks every /receipts/feed.xml invariant (namespace, required children, freshness vs the on-disk spec bundle built at deploy time, permalink reachability), and surfaces 7 verdict bands: OK / STALE / STALE_PAST_SHELF / FUTURE_DATED / SHAPE_BAD / COUNT_MISMATCH / DEAD_PERMALINK. Banner aggregates X fresh · Y aging · Z stale · W broken plus an auditor's-pick that flags the single most-problematic entry as the priority fix target. Paste a https://hool.dev/receipts/feed.xml URL, paste the raw feed XML, or pre-fill with the literal live hool.dev bytes — the inspector parses ~200 lines of hand-rolled JS, no library to trust.

2026-09-28
✓shippedcolophon Inventory-drift cadence P134-P238 shipped; ledger drift self-caught — inventory-drift cadence items shipped and deployed since the 2026-09-20 entry, each with its own QUEUE row, commit chain and (for SHIP+deploy cycles) live deploy probe: P134 through P238 (last live deploy d27fe3f7 at cycle-752 on 2026-09-27). Net effect across those deploys: the inspector registry grew 118 to 222 rows (P239 SHIPPED locally at cycle-755, pending this deploy, takes it to 223) and the cycle index 579 to 1300 cycles, with the FLOOR trio byte-identical throughout. Why this entry exists: the receipts-ledger freshness check (cap 7 days) failed on 2026-09-28 — the cadence SHIPs landed without public ledger entries for 8 days. The verifier caught its own ledger going stale; this entry restores it to GREEN with the backlog, unedited history. Permalink.
2026-09-20
✓shippedcolophon Inventory-drift cadence P129-P133 shipped; ledger drift self-caught — five rule-7 inventory-drift cadence items shipped and deployed since the 2026-09-12 entry, each with its own QUEUE row, commit chain and live deploy probe: P129 (cycles 419-421), P130 (cycles 422-424), P131 (cycles 425-427), P132 (cycles 428-430, deploy 90499308), P133 (cycles 431-433, deploy af03a838), plus P134 proposed at cycle-434. Net effect across those deploys: the inspector registry grew 113 to 118 rows and the cycle index 547 to 579 cycles, with every deploy verified live (apex + preview HTTP 200, cache-busted probes) and the FLOOR trio byte-identical throughout. Why this entry exists: the receipts-ledger freshness check (cap 7 days) failed on 2026-09-20 — the cadence SHIPs landed without public ledger entries for 8 days. The verifier caught its own ledger going stale; this entry restores it to GREEN with the backlog, unedited history. Permalink.
2026-09-12
✓publishedwork SPARC portfolio case shipped — added to /work/. Excerpt: "At Rockfish, John led product work on Walmart's SPARC supplier platform, connecting the supplier experience with onboarding, licensing, and administration." Project story: At Rockfish, I led product work on Walmart's SPARC supplier platform. It helped suppliers see store inventory and act on that information. My work connected that supplier experience with the onboarding, licensing, and administration needed to run the product. Before gaining access, suppliers needed to register, bring employees into the system, buy and assign licenses and badges, and complete training. Those steps were part of the product experience alongside the inventory information. We developed the portal through successive builds, with separate administrator and employee workflows, CSV imports, checkout, and support tools. The designs addressed practical problems such as conflicting imports, replacement badges, and registration emails that failed to arrive. I led the product work and briefed contributors as it developed. SPARC brought together the supplier-facing experience, the commercial model, and the administration behind it. That combination is a good example of the work I enjoy: understanding a complicated business process and helping a team turn it into a product people use. Figures: Project records showed 26,000 licenses and a $37 license fee as of March 2014. These are historical license figures, not a measure of monthly active users. Permalink.
2026-09-08
✓publishedwork Foundry portfolio case shipped — added to /work/. Excerpt: "Production AI-enabled quote, repair, and invoice workflows on Palantir Foundry, used by external repair-shop partners. John's contribution included UX and architecture designs." Project story: At America's Car-Mart, I launched production AI-enabled quote, repair, and invoice workflows on Palantir Foundry. My contribution included the UX and architecture designs. The product crossed company boundaries: external repair-shop partners used it to submit their quotes and invoices. Adoption was required for those submissions, and human review remained part of the automated workflow. The result was a production system used by external business partners. This project connects three areas of my work: enterprise product delivery, UX design, and technical architecture. Permalink.
2026-09-07
✓deployedcolophon `P85 SHIPPED cycle-276 — colophon inspector-family inventory-drift cleanup part 19 (73-row cadence item, 18th iteration of the inventory-drift-cadence pattern, lane-decideable additive chrome per RAT-12 + SOUL L6 + product-owner grant 2026-08-21) — P84 wedge=65 row appended to data/__INSPECTOR_REGISTRY.json position 73 (registry 72->73, first_shipped_cycle cycle-275 + first_shipped_sha7 6e27416) + scripts/test-inspector-versions.py F1-F6 recalibrated 73-row baseline F1/F2/F3/F5/F6 spec_stale 60->60 + F4 spec_stale 61->61 + cycle_index_drift 3->4 (the 73-row audit signal: 9 current / 60 SPEC_STALE / 4 CYCLE_INDEX_DRIFT / 0 BUNDLE_STALE / 0 MISSING_REGISTRY) + scripts/gen-cycle-index.py 318->320 cycles + scripts/gen-git-log-summary.py 30 commits refreshed + 11-file cascade re-bundle (data/cycle-index.json + data/git-log-summary.json + public/colophon/{__INSPECTOR_REGISTRY.json 72->73 rows, cycle-index.json 320 cycles, git-log-summary.json 30 commits, inspector-manifest.json 2 routes} apex mirrors + public/fingerprint/{disk-hashes.json 107 files} apex mirror + 5 chrome prose refs in public/colophon/index.html 72->73 (line iv-registry-count span + Audit-all button label + idle text + source-of-truth prose with cycle-count 315->320 + empty-table placeholder) + 5 chrome delta from inline re-injection on /fingerprint/ disk-hashes block). HOOL-2 4/4 GREEN at main HEAD 8208677 pre-deploy + post-deploy (bash scripts/verify-claims.sh exit 0 RESULT CARD CONTRACT HOLDS incl P65 reading '8/8 PASS across 73 registry rows / 320 cycles / 30 git-log commits' + P48 disk-cdn-drift wired + P66 sitemap-freshness 9/9 wired across 54 urls ; python3 scripts/verify-colophon.py exit 0 RESULT COLOPHON CONTRACT HOLDS ; python3 scripts/test-inspector-versions.py 8/8 PASS ; git diff --check exit 0 clean ; FLOOR trio md5 9c1636c7 + e89e3d17 + 081b70d3 BYTE-IDENTICAL preserved). LIVE APEX PROOF cache-busted (curl 'https://hool.dev/colophon/?cb=1788743820' HTTP=200): inline script id=inspector-registry registry=73 rows last row id=P84 wedge=65 + id=cycle-index cycles=320 + id=git-log-summary commits=30 + span id=iv-registry-count reading 73 + button 'Audit all 73 inspector versions' + md5 of downloaded live /colophon/index.html BYTE-IDENTICAL to local public/colophon/index.html. ZERO 72 stale chrome residue + FLOOR trio BYTE-IDENTICAL end-to-end. STRIKE taxonomy 0+0+0. LANE-DECIDEABLE stock 46 SHIPPED + 0 STAGED-IN-WORKTREE + 10 PROPOSED at end of cycle-276 SHIP = 48 inspectors across 7 pages (P10..P85 minus P49). John-gated stock 5 unchanged (P16 light-mode palette swap + P16 sibling cards headshot + P16 sibling cards CC0 grant + CarMart + posting-as-John). Receipt: /receipts/2026-09-07-p85-shipped-cycle-276-colophon-inspector/.
✓verifiedcolophon `P85 STAGED-IN-WORKTREE cycle-275 — colophon inspector-family inventory-drift cleanup part 18 (the 73-row cadence item, docs-only PROPOSED cycle-274 + STAGE cycle-275 + SHIP cycle-276) — append P84 wedge=65 row to data/__INSPECTOR_REGISTRY.json position 73 + scripts/test-inspector-versions.py F1-F6 recalibrated 73-row baseline + 5 chrome prose refs in public/colophon/index.html 72->73 + cascade re-bundle of 14 files + HOOL-2 4/4 GREEN at worktree HEAD post-STAGE. Sibling of P82/P83/P84 SHIPPED (the 15th/16th/17th iterations of the inventory-drift-cadence pattern) — the cadence has held across 18 iterations without John intervention, evidence the lane can sustain same-posture 3-cycle PROPOSED+STAGE+SHIP loops on lane-decideable additive chrome. Receipt: /receipts/2026-09-07-p85-staged-in-worktree-cycle-275/.
✓verifiedcolophon `P85 PROPOSED docs-only cycle-274 — colophon inspector-family inventory-drift cleanup part 18 forecast row (73-row cadence item, future-facing row only) — docs/ops/QUEUE.md cycle-274 P85 PROPOSED run-log row appended at line 367 + wiki/JOURNAL.md cycle-274 PROPOSED dated entry prepended above cycle-273 SHIP at top. PROPOSED is docs-only, no chrome touched, no cascade re-bundle — the FLOOR trio cannot change because no chrome file is modified. Schedules cycle-275 STAGE (worktree branch + 14-file chrome + cascade re-bundle + HOOL-2 4/4 GREEN at worktree HEAD) + cycle-276 SHIP (ff-merge + push origin + flock deploy.sh + apex cache-busted probe iv-registry-count 73 live + ZERO 72 stale chrome residue + FLOOR trio BYTE-IDENTICAL). Same posture 18-iteration cadence per docs/ops/GOAL-PROMPT.md rule-7. Receipt: /receipts/2026-09-07-p85-proposed-docs-only-cycle-274/.
✓deployedcolophon `P84 SHIPPED cycle-273 — colophon inspector-family inventory-drift cleanup part 17 (72-row cadence item, 17th iteration of the inventory-drift-cadence pattern, lane-decideable additive chrome per RAT-12 + SOUL L6 + product-owner grant 2026-08-21) — P83 wedge=64 row at data/__INSPECTOR_REGISTRY.json position 72 + scripts/test-inspector-versions.py F1-F6 recalibrated 72-row baseline + 5 chrome prose refs in public/colophon/index.html 71->72 + scripts/gen-cycle-index.py 317 cycles + scripts/gen-git-log-summary.py 30 commits refreshed + 14-file cascade re-bundle. HOOL-2 4/4 GREEN at main HEAD d9f8b62 pre-deploy + post-deploy. LIVE APEX PROOF cache-busted (curl 'https://hool.dev/colophon/?cb=1788723260' HTTP=200 849252 bytes md5 8d588653df17906214c14d6ef1799237 BYTE-IDENTICAL to local public/colophon/index.html) + iv-registry-count 72 live + 3 chrome instances 'Audit all 72 inspector versions' + ZERO 71 stale chrome residue + FLOOR trio BYTE-IDENTICAL end-to-end. Receipt: /receipts/2026-09-07-p85-shipped-cycle-276-colophon-inspector/.
2026-08-30
✓deployedcolophon `P38 SHIPPED cycle-145 — colophon per-capture-age auditor's-pick (capture-age temporal validity inspector on /colophon/#network .sec-b body inspector; FRESH/AGING/STALE/FALSIFIED shelf bands from HEAD Date header on /body-snapshot.txt) — sibling of P32 sec-h + P33 expiry + P34 claim-expiry + P36 live-fetch + P37 body-hash; the temporal-validity family is now mirrored onto the body inspector; closes the per-capture-age wedge the lane let drift after cycle-137. FloOR+FLOOR-snapshot+og/john.png md5 trio BYTE-IDENTICAL preserved 9c1636c7/e89e3d17/081b70d3; verifier trio 3/3 GREEN post-deploy incl new P38 check #14; deploy URL https://0d219e31.hool-dev.pages.dev. Receipt: /receipts/2026-08-30-p38-shipped-cycle-145-colophon-per/.
✓deployedcolophon `P37 SHIPPED cycle-143 — colophon body-hash inspector (Content-Type + body SHA-256 + status) on /colophon/#network .sec-b div, sibling of P32 sec-h + P36 live-fetch — visitor pastes a URL or text, page fetches `/body-snapshot.txt` via `fetch(url, {cache:'no-store'})` and computes the SHA-256 in-browser via SubtleCrypto, comparing against the visitor-pinned expected hash; mismatch ⇒ red "this body has been modified since publication" banner. Closes the body inspector family wedge. FloOR+FLOOR-snapshot+og/john.png md5 trio BYTE-IDENTICAL preserved 9c1636c7/e89e3d17/081b70d3; verifier trio 3/3 GREEN post-deploy incl new P37 check #13 'starts with HTML doctype'; deploy URL https://45aec720.hool-dev.pages.dev. Receipt: /receipts/2026-08-30-p37-shipped-cycle-143-colophon-body/.
✓deployedcolophon `P36 SHIPPED cycle-141 — colophon live-fetch headers button on /colophon/#network .sec-h div (refetches /headers-snapshot.txt maintained by deploy.sh post-deploy step) — sibling of P32 sec-h + P34 claim-expiry; visitor clicks "live-fetch headers" → page refetches the apex headers-snapshot live, comparing against the disk-served snapshot, surfacing drift. Closes the headers temporal-validity wedge. FloOR+FLOOR-snapshot+og/john.png md5 trio BYTE-IDENTICAL preserved 9c1636c7/e89e3d17/081b70d3; verifier trio 3/3 GREEN post-deploy incl P36 check #12 'headers-snapshot 1091 bytes'; deploy URL https://01a9c8a5.hool-dev.pages.dev. Receipt: /receipts/2026-08-30-p36-shipped-cycle-141-colophon-live/.
✓deployedcolophon `P34 SHIPPED cycle-139 — colophon claim-expiry inspector (ref-date + SHELF map + per-claim PASS/AGING/STALE/NEVER verdict) on /colophon/#claim-law .col-exp div, sibling of P32 sec-h + P33 expiry — visitor pastes a reference date, page audits the literal colophon claim-contract sentences (16 LOAD_HOOL_DEV claim lines mirroring /colophon/#claim-law + verification + palette + network + release contract) against the SHELF map (foundation 0=NEVER / contract 180 / measurement 90 / security 365 / route 90 / palette 180 / fingerprint 7 / default 90); ratio <0.80=PASS / 0.80..<1.00=AGING / >=1.00=STALE; auditor's pick = oldest non-NEVER claim. FloOR+FLOOR-snapshot+og/john.png md5 trio BYTE-IDENTICAL preserved 9c1636c7/e89e3d17/081b70d3; verifier trio 3/3 GREEN post-deploy; deploy URL https://8bd1a690.hool-dev.pages.dev. Receipt: /receipts/2026-08-30-p34-shipped-cycle-139-colophon-claim/.
2026-08-28
✓deployedsecurity-disclosure `/.well-known/security.txt` RFC 9116 disclosure (cycle-112, P26, lane-decideable under HOOL-2 PRE-ACTION GATE) — 952-byte well-known security disclosure file at public/.well-known/security.txt (canonical URL https://hool.dev/.well-known/security.txt), RFC 9116 §4 well-known URI format. Fields: Contact: mailto:[email protected] + Contact: https://github.com/johnmwhitman + Expires: 2027-08-28T19:30:22Z (12-month rolling, ISO 8601 with Z UTC marker per RFC 9116 §3) + Preferred-Languages: en + Canonical: https://hool.dev/.well-known/security.txt + Policy: https://hool.dev/colophon/#claim-law + Acknowledgments: https://hool.dev/receipts/. Mailto is the canonical contact already disclosed in /llms.txt + /about/ JSON-LD email field — no new contact surface introduced. The file is its own surface (well-known URL, RFC 9116), so no chrome page was added; wired anchors only via /llms.txt (no change needed) + /colophon/#claim-law + /receipts/. Taste-gate CLEAR per §3: well-known path is an established convention (RFC 8615 §2.2); the file is a copy of the canonical contact from /llms.txt + /about JSON-LD; no FLOOR adjacency; no big interactive; no chrome change. RFC 9116 is the same family of convention as /llms.txt (LLM fact-sheet, also a well-known convention) and /fingerprint/ (machine mirror of /colophon/#verification). Wiki writeback: wiki/02-pages.md new P26 section mirroring P24 format. Lane-decideable per RAT-12: S effort additive chrome, single deploy, no John-gated surface. Receipts: verify-claims 7/7 PASS (incl. WCAG AA contrast-cli 0 failures across 3 audited pages); verify-colophon 7/7 PASS; git diff --check exit 0; FLOOR md5 9c1636c7 BYTE-IDENTICAL to origin/main pre-deploy + FLOOR-snapshot md5 e89e3d17 BYTE-IDENTICAL + og/john.png md5 081b70d3 BYTE-IDENTICAL; 8/8 cache-busted apex probe CLEAN (FLOOR stale-marker check on /?z=1..8, no the-employer-named-as-client-brand or D2[0-3] matches); 8/8 cache-busted probe on /.well-known/security.txt?z=1..8 BYTE-IDENTICAL (HTTP 200, content-type text/plain; charset=utf-8, 952 bytes, body md5 ae28235e06fbbce7716e43d6d2480734 matches local public/.well-known/security.txt; canonical security headers in place — strict-transport-security: max-age=31536000, content-security-policy: default-src 'self', cache-control: public, max-age=300, must-revalidate, etag: "b2f45da7cdc6c31cea4560720b768739"). Guardian pre-deploy gate: WARN (non-blocking) — 2 pre-existing MEDIUM findings about decision-ID references in public/changelog/index.html:218 + public/llms-full.txt:1553 (both predate this cycle; not introduced by P26); 8 ALLOW Car-Mart-as-employer mentions. Guardian post-deploy gate: PASS — 0 blocking findings; firewall_live 4 ALLOW Car-Mart-as-employer. Rebase path: fresh p26-well-known-security-txt-20260828 branch off current main a395e28 (cycle-111 push recovery HEAD); single cycle-112 chrome commit 35afac5; FF-merged → local main 35afac5; pushed origin/main a395e28..35afac5; ahead-behind 0/0. Production deploy: ./deploy.sh exit 0; allowlist tree clean 92 public files; Cloudflare Pages deployment 7f929239 → preview URL https://7f929239.hool-dev.pages.dev; apex live at https://hool.dev/.well-known/security.txt. Live verified 8x cache-busted apex probes 8/8 = 200 + 952 bytes + BYTE-IDENTICAL to public/.well-known/security.txt.
✓deployedfingerprint `/fingerprint` machine-readable mirror of /colophon/#verification (cycle-105, kanban t_) — live, dated md5 + URL map of every public route and asset on hool.dev (38 entries: 18 chrome routes + 13 root assets + 3 fonts + 3 OG card variants); companion JSON at /fingerprint/index.json with {generated_at, domain, total, entries:[{path, md5, url, kind}]} shape (one fetch, one parse). Cream/ember editorial canon (matches /changelog/, /now/, /press-kit/); self-hosted Fraunces + JetBrains Mono (SIL OFL); honors prefers-color-scheme (paper-on-ink dark variant); does not touch THE FLOOR. Generated by scripts/gen-fingerprint.py (NEW, 16.1KB / 292 lines / standalone Python 3 stdlib only; md5-walks public/, emits HTML + JSON; deterministic ordering: FLOOR first then routes alpha, root assets alpha, fonts alpha, og alpha; idempotent for unchanged tree). Wired: public/colophon/index.html (Local-verifier <dd> appended one sentence pointing to /fingerprint/), public/llms.txt (Surfaces table Fingerprint row), public/sitemap.xml (<url> entry between /changelog/ and /sims/transit-sim-v6.html), wiki/02-pages.md (new /fingerprint/ section after /lab/simplex-noise/). Verify-claims 23/23 PASS, verify-colophon 7/7 PASS, contrast-cli 0 AA failures, git diff --check exit 0; 11/11 fingerprint local hrefs return 200 + FLOOR md5 = 9c1636c7 matches the table's FLOOR row. Rebase path: fresh p23/fingerprint-20260828 branch off current main af384fe (cycle-104 commit), single cycle-105 chrome commit 721f0cc, FF-merged → local main 6db2650; pushed origin/main af384fe..6db2650; ahead-behind 0/0. Production deploy: flock -n ~/AI/agents/.hermes/heavy-build.lock bash deploy.sh from /Users/johnwhitman/AI/hool.dev → Cloudflare Pages production at https://b53e5eee.hool-dev.pages.dev (5 files uploaded, 82 already uploaded, 1.00s); Guardian pre-deploy WARN (non-blocking — 9 ALLOW firewall_live on Car-Mart mentions unchanged from cycle-104) + post-deploy PASS (4 ALLOW firewall_live checks, 0 blocking findings). Apex cache-buster probe (10 iterations curl https://hool.dev/?z=N): 10/10 CLEAN — no stale residuals on the FLOOR; direct probes /fingerprint/ → 200, /fingerprint/index.json → 200. Advisory (not a lane defect, document-only): curl https://hool.dev/ returns a FLOOR page with the same content, structure, design, and intent as public/index.html (md5 9c1636c7b12c69f894c3bca70da89c3d), but with ~159 bytes of Cloudflare edge-injected email-decode wrappers (data-cfemail + cdn-cgi/scripts/cloudflare-static/email-decode.min.js on the two mailto:[email protected] occurrences); local file is unchanged from what I uploaded, edge transform outside lane control, FLOOR contract intact (content + structure + design + hashes all match upload); this is the documented CF auto-Email-Address-Obfuscation behavior, not a deploy action; verify-claims.sh measures the local working tree, not apex bytes, so the receipt is intact. Worktree at /Users/johnwhitman/AI/.worktrees/hool-p23-fingerprint-20260828 kept for parity; cycle-105 row appended to docs/ops/QUEUE.md; cycle-105 mirror row appended to ~/AI/agents/.hermes/profiles/hool/QUEUE.md; cycle-105 dated entry appended to wiki/JOURNAL.md. STRIKE taxonomy: 0. Net change this cycle per git diff --stat: 7 files / +732/-1 (public/fingerprint/index.html NEW 167 lines, public/fingerprint/index.json NEW 235 lines, scripts/gen-fingerprint.py NEW 292 lines, public/colophon/index.html +1/-1, public/llms.txt +1/-0, public/sitemap.xml +6/-0, wiki/02-pages.md +30/-0). FLOOR + FLOOR-snapshot + og/john.png BYTE-IDENTICAL to P22 + P18 + cycles 91-100-101-102-103-104. Lane-decideable count: STAGED 0 unchanged, PROPOSED 1 → 0 (P23 built and shipped directly from PROPOSED per protocol); John-gated unchanged at 2 (P16 palette + sibling cards; DM darkmode taste).
2026-08-27
✓deployedpress-kit `/press-kit` journalist- and conference-organizer-facing page (cycle-90, kanban t_5dff6603) — cream/ember editorial canon (matches /about/, /now/); three copy-paste-ready bio blocks (50/100/200 words with word-count hint), canonical-URL table (entity/brand/work/book/receipts/colophon/now/one-pager/llms.txt/LinkedIn/GitHub/ Substack/PyPI/meshfleet), contact cards (email, handles, portrait, disambiguation block), disclosure paragraph (the fleet is personal work, not Car-Mart's). CRMT-blur grk-fixup applied (mirrors P16 grk-fixup e8ae56d): og:description corrected to add "at America's Car-Mart; on his own time," separator; 200-word bio paragraph 1 swapped AI-agent focus out of the employer sentence; 200-word bio paragraph 2 added explicit "On his own time — separate from his employer" separator. Wired: sitemap.xml (new entry, lastmod 2026-08-27T08:00+00:00), llms.txt (Surfaces table row + Update cadence date), /about/ (companion link in the "if you're a human reading this" paragraph), wiki/02-pages.md (new section). Verify-claims 23/23 PASS, verify-colophon 7/7 PASS, contrast-cli 0 AA failures, git diff --check exit 0; 11/11 press-kit local hrefs return 200; FLOOR md5 9c1636c7 byte-identical. Rebase path: created fresh deploy/p13-press-kit-20260827 branch off current main 1a718dc, applied P13's net diff (3 commits b061273 + e513c1b + 4c6de32) as one consolidated 5-file patch instead of a 238-commit rebase storm. Lane-decideable per RAT-12.
✓deployedreceipts This page grew a chart of itself — a bar per date that added a dated entry to this ledger, drawn by uPlot v1.6.31 (MIT, © Leon Sorokin 2022) self-hosted at /receipts/vendor/uPlot/v1.6.31/. No CDN at view time. Readers without JS get a table of the same numbers. The chart was staged on 2026-08-18 claiming 23 entries across 10 dates and shipped reading 31 entries across 12 dates, because the staged copy had gone stale and the numbers are now derived from the dated permalink folders instead of typed by hand. A new verifier assertion (check 10d in scripts/verify-claims.sh) compares all three places the chart states a number — the data array, the no-JS table, and the heading — against the folders on disk, so this chart cannot drift from the ledger the way its first draft did. Verified by re-running: 20 PASS, and a deliberate re-injection of the stale 23/10 heading failed the gate before deploy.
✓deployedcolophon `/verify` Verification section merged into `/colophon` — the brand promise ("if this site says it, you can check it") now lives inside the System Annex with three handles: receipt permalinks, claim→receipt deep links, and the local verifier. Registry nav points to it; meta + sitemap lastmod bumped to 2026-08-18. Seven sections in source order — authority, release, stack, network, provenance, claim-law, verification — pinned by scripts/verify-colophon.py.
✗self-caughthonesty This ledger drifted 35 days behind the deploy cadence — caught and fixed — between 2026-07-23 and 2026-08-27, seven prod deploys (cycle-74 A1, cycle-75 A2, cycle-76 P5, cycle-77 P7, cycle-78 P6, cycle-80 P4, this one) shipped without regenerating /receipts/, and the footer "ledger dated 2026-07-19" went stale. Root cause: scripts/gen-receipts.py existed but was never wired into deploy.sh, and the claim-drift verifier had no recency assertion. Both fixed in this pass: deploy now regenerates /receipts/ from source every run, and scripts/verify-claims.sh gains check #10 (newest ledger entry ≤7 days old, footer date matches newest entry, feed <updated> matches newest entry). Seven entries below catch the missing streak.
2026-08-26
✓deployedwork Claim→receipt chips on `/work` (cycle-80) — six inline anchors on the surface status line and each named product/portfolio card, each pointing to its permalink on this ledger. Live apex probe 5/5 cache-busted, chip-href sweep 6/6. Conflicts on public/work/index.html resolved surgically (kept HEAD's 2026-08-26 re-verification dates; layered chip CSS on top).
✓deployedcard `/card` recruiter-mode one-pager (cycle-78) — calm, single-page operator card at hool.dev/card/, contract-gated by the new operator-card check in scripts/verify-claims.sh. Forward-port of the archived a5 one-pager with current facts and a real mailto: link.
✓deployedstats `/stats` verified metrics page (cycle-77) — 19 stat-cards across four sections (MeshFleet npm, last-stage-capacity PyPI, the MeshFleet bus, this site itself); every number carries a source URL and a fetch timestamp. No static count asserted anywhere on the page; the audit table is sourced live.
✓deployedcorrections `/corrections` failure-museum route (cycle-76) — five real cited failures (2026-08-16 P6 quarantine, 2026-07-23 ledger overclaim, 2026-07-09 edge-cache staleness, 2026-07-06 internal-docs leak, 2026-07-04 legal-pages gap) each linking its receipt permalink. Cross-repo drift resolved on public/llms.txt + public/sitemap.xml.
✓deployeda5 A2 a5 one-pager staleness audit (cycle-75) — archived a5_personal_brand_v0.1.html refreshed: head metadata, real mailto:[email protected], body kept BYTE-IDENTICAL to canonical FLOOR via new guard scripts/audit-a5-vs-index.sh. Quiet nav to /start, /work, /about.
✓deployedwork A1 `/work` cards refresh (cycle-74) — every fact own-hands re-verified 2026-08-16→26: live 200s on thumbpack.com, meshfleet.app, fleetopus.com, arkfunk.com, yourbrief.io, routeplane.app, book.hool.dev; npm meshfleet=0.20.0 (registry, MIT LICENSE read), PyPI last-stage-capacity=1.0.0, YourBrief repositions to pricing briefs, ArkFunk "funky" dropped from live title, RoutePlane ~18-models → "29 providers and 232 models" sourced live, book $12 founding tier still true. Bus-count (18,404) added to constitution-receipt anchor on the Hermes fleet card.
2026-07-23
✓deployedsecurity Serve-by-allowlist migration live — the served tree moved to public/: safety is now a property of the repo layout, not of a deploy-script exclude list. Internal material physically cannot ship. Payload parity proven byte-identical before the move; deploy audits negative-tested; 9/9 internal-path probes return 404; the DMZ override verified on apex, www and the Pages fallback.
✗self-caughthonesty This ledger was overclaiming — corrected — an audit of every numeric claim on this site found the entry below (2026-07-03) presenting the author's own $1 smoke-test purchase as an outside "founding reader," and declaring the zero-revenue line retired. Every literal fact in it was true; it still read as outside traction that does not exist. Rewritten. Autonomous-sourced sales remain 0. Same sweep: the book page overstated its length by ~9,400 words and /start/ quoted a stale ledger count. A guard (scripts/verify-claims.sh) now fails the deploy if any of these recur.
2026-07-19
✓deployedship Ledger + $12 truth-sync live; hygiene pass — this backfilled ledger and the corrected /book/ pricing deployed and verified. Same pass: removed a dead CSP carve-out for an unused analytics surface, fixed stale machine-readable metadata (llms.txt, sitemap, manifest), pruned five dead git branches. Verified with cache-busted sweeps against the origin.
2026-07-18
✓committedrevenue Book funnel truth-synced to $12 — /book/ still said "Polar $1 tier" after the founding reprice, and Editions omitted the only buyable tier. cta-note fixed; Founding-reader $12 card added. Cross-repo drift: the book lane moved, this funnel didn't follow until commit 61e16eb.
✓committedship In-repo wiki knowledge base stands up — HOME + journal + six reference pages consolidating lane truth; wiki/ excluded from deploy so markdown knowledge cannot publish. Commit 191bef9.
2026-07-10
✓fixedship /about CSS stomp fixed — rogue tokens.css links on five self-sufficient pages were overriding page-local styles; links removed, file quarantined. Canonical /book/ → book.hool.dev. Commit b57e1b6.
2026-07-09
✓fixedship Stale edge-cached asset overridden for good — a stuck CDN asset kept serving old path content after the purge; durable manifest override lands a benign "Not available" body instead of internal material. Commit f1b1aaf.
✓hardenedaudit HSTS lands on hool.dev — Guardian headers-check finding closed; Strict-Transport-Security added to site headers. Commit cce16b0.
2026-07-08
✓shippedship Clean-staging deploy discipline — deploy.sh deploys from a public-only staging dir; residual internal refs scrubbed; deploy gated so the next ship can't re-leak. Commits d267cbb + fe6d943.
✗purgedaudit Security purge of internal material — residual training links and internal strings scrubbed from the public tree after the stop-the-bleeding work. The unflattering fact: it was still in the tree. Commit c0fd509. This entry stays.
2026-07-06
✗caughtaudit hool.dev was serving internal docs — assetsignore + cfignore + _redirects 404 backstop stop the public tree from publishing non-public markdown. Commit 4c3ee79. This entry stays.
2026-07-04
✗04:44:19Zsweep Post-deploy sweep caught a live outage next door — legal pages and this ledger verified live, but withmnemo.com's apex stopped answering mid-DNS-migration (www serves, apex misconfigured on the new host). Flagged to that product's lane the same minute; recovered by the 04:48:47Z sweep — all checks green. The ledger's first catch was published by the page that caught it.
✓deployedship Legal pages live + this page ships — /legal/privacy·terms·copyright·disclaimer serve real content (the old redirect-to-/about/ hijack is gone), and THE RECEIPTS goes public. Merge commits e7e5870 + 38631c2.
✓mergedfix PR #3 merged — real /legal/ pages ship, post-first-dollar copy lands, /work truth-sweep: canonical domains (arkfunk.com, fleetopus.com), YourBrief → live, per-card verified dates. Merge commit e7e5870.
✗04:28:35Zsweep Extended sweep caught a real gap — /legal/* still 301-redirected in production while the plan claimed the pages were done. Everything else green (22 checks). The fix is the PR above. This entry stays.
✓03:57:48Zsweep Full verification sweep: all core surfaces, all portfolio cards, book canonical + fallback — 18/18 checks 200.
✓02:58:24Zsweep Clean sweep at prior-session close — all checks passed.
✓verified e2erevenue Book money path proven end-to-end — "Human Out of the Loop" order #1 via the Polar $1 tier: payment, fulfilment and delivery all verified. The buyer was John, the author. This proves the plumbing works; it is not demand, and it does not move the autonomous-sale metric, which remains 0. Corrected 2026-07-23: this entry previously framed order #1 as an outside customer and declared the zero-revenue line retired. It was never an outside customer. The correction stands as part of the record.
2026-07-03
✓dns attachedlaunch book.hool.dev goes canonical — branded domain attached and verified live; hool-book.pages.dev retained as fallback only.
✓sweep #1sweep First automated portfolio verification: 9/9 live URLs returned 200, zero dead links, badges accurate.
✓mergedship /book wing ships (PR #2, merge 0b03b30) — the book gets its hub on the main brand, additive; the FLOOR untouched.
2026-06-12
✓dispatch d22audit The page fact-checked itself — every count, status and price on the FLOOR re-verified against fleet receipts; stale numbers corrected, unprovable numbers removed. Receipts at /receipts/.
✓dispatch d21ship THE FLOOR built unattended — the homepage of this site was designed and shipped by the fleet under one open brief. Previous build preserved at /gallery/.
the fleet era
✓06:08Zorigin Constitution ratified by peer quorum — ten agents, one human, 18,404 bus messages on a consumer desktop. The full story is the book.

How this page works: verification entries are produced by an automated sweep the fleet runs against the live site — HTTP status on every surface and portfolio card, redirect traps on pages that must serve directly, and title assertions so a parked or hijacked domain can't pass as a healthy 200. Failures are published, not buried. The ledger is regenerated when the fleet ships; if the newest entry looks stale, that itself is a signal.