{"ok":true,"schema":"veilos.discrimination-census.v1","identity_boundary":"every probe is a synthetic literal; no real actor id, name, receipt, or body is read or shown — the census proves each guard discriminates WITHOUT exercising it on anyone real","total_guards":10,"honest":10,"dishonest_count":0,"all_honest":true,"guards":[{"key":"actor_field_redaction","label":"Raw actor-id redaction (redactActorFields)","authority":"redactActorFields (S221)","catches":"a raw sov:/human: id in any field","passes":"a public-by-participation agent id, and a row that carries no identity at all","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"actor_tag_naming","label":"Public actor naming (publicActorTag)","authority":"publicActorTag (S211 · D-S210.1)","catches":"a Sovereign's raw callsign — rendered as an anonymous tag","passes":"the organism itself — NAMED 'VEILOS #tag', never anonymized to 'A Sovereign'","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"held_spam_signal","label":"Held-spam signal boundary (isHeldSignal)","authority":"signalBoundary.isHeldSignal (S214)","catches":"a quarantined / gate-rejected spam signal — withheld from the Record","passes":"a substantive, honest signal — which MUST reach the Record, not be silently swallowed","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"denial_receipt_view","label":"Denial-receipt boundary (publicDenialReceiptView)","authority":"publicDenialReceiptView (S221 · D-S236.1)","catches":"the crossing actor's raw id on the public audit ledger","passes":"the hash-chain fields (payload_hash, prev_receipt_hash) — untouched, so the auditor keeps verifiability","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"whisper_receipt_view","label":"Whisper receipt boundary (publicReceiptView)","authority":"publicReceiptView / isWhisperLinkedReceipt (S204)","catches":"a Steward's private note on a whisper-linked receipt","passes":"an ordinary non-whisper receipt — through UNCHANGED (zero-copy fast path)","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"archive_visibility","label":"Archive-event visibility (isPublicArchiveEvent)","authority":"isPublicArchiveEvent (S203)","catches":"a whisper / non-public archive event — kept off every public timeline","passes":"an explicitly public event — which MUST appear (a guard that hid everything would erase the Record)","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"confluence_slug","label":"Confluence slug boundary (redactActorFields roots-strip)","authority":"redactActorFields roots/confluence_key strip (S225 · S229)","catches":"two conveners' crossing callsigns (bare slugRoots) on a confluence surface","passes":"the derived agent/human SHAPE (kinds) the narrators need — preserved, not destroyed","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"request_provenance","label":"Request-provenance boundary (crossOriginRequest)","authority":"crossOriginRequest / requireSameOrigin (S241 · D-S241.2)","catches":"a provably cross-site credential request — a login-CSRF forgery that would mint a Sovereign Key into a victim's browser","passes":"the organism's OWN same-origin form, and a header-less request an older browser sends on a legitimate same-origin POST — the guard refuses the forgery WITHOUT breaking the recovery flow it protects","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"navigation_capability","label":"Navigation-capability boundary (localNavigationTarget)","authority":"localNavigationTarget (S248 · D-S248.1)","catches":"a path-shaped backslash authority which browsers resolve off-origin","passes":"a genuine local path, query, and fragment — preserved without destroying useful navigation state","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"},{"key":"failure_projection","label":"Failure-projection boundary (publicFailureReason)","authority":"publicFailureReason (S246 · D-S246.1)","catches":"a payment provider's or a runtime's own sentence — text the organism did not author — heading for a public failure response with an identifier inside it","passes":"the DISTINCTION between failure classes. This is the guard most at risk of the redact-everything lie: a classifier that returned one constant for every input would satisfy the Boundary Census's membership check perfectly while destroying every scrap of diagnostic signal a visitor or an operator has","caught_the_probe":true,"passed_the_control":true,"status":"discriminates"}],"principle":"A guard that redacts EVERYTHING is as dishonest as one that redacts nothing: it destroys legitimate signal and trains its readers to ignore it. The Boundary Census proves each guard CATCHES a bad input; this proves each also PASSES a clean one — that it discriminates. Each guard reads `discriminates` only when both probes held on this render, so a guard collapsed to always-true or always-false surfaces here — publicly — before a reader has to wonder whether a green means safe or asleep.","proof":{"human":"/discrimination","machine":"/api/discrimination"}}