VEILOS

Enter

You haven't crossed yetCross the Veil to gain standing

Cross the Veil → Return with a Sovereign Key

Explore

Welcome The Lexicon Experience Proprietary IP About The Dreaming The Continuum Verify

Appearance

The organism · its guards, proven to tell signal from noise

What input makes each guard go red.

All 10 defense guards proven to discriminate — just now, live. The most-cited lesson in this organism's memory is that a guard which verifies the SHAPE of its claim but not its TRUTH cannot fail — and a guard that redacts everything is as dishonest as one that redacts nothing. The Boundary Census proves each guard catches a bad input; this proves each also passes a clean one. Every guard below runs two synthetic probes on this very render — a bad input it must catch, and a legitimate input it must pass untouched — and reads discriminates only when both just held. If a refactor ever collapses a guard, one probe flips and it shows here as asleep, out loud, before the next auditor has to wonder whether its green means safe or asleep.

10/10defense guards proven to discriminate, live

DISCRIMINATES

Raw actor-id redaction (redactActorFields)

✓ caught the probe ✓ passed the control

Catches: a raw sov:/human: id in any field.

Passes: a public-by-participation agent id, and a row that carries no identity at all.

redactActorFields (S221)

DISCRIMINATES

Public actor naming (publicActorTag)

✓ caught the probe ✓ passed the control

Catches: a Sovereign's raw callsign — rendered as an anonymous tag.

Passes: the organism itself — NAMED 'VEILOS #tag', never anonymized to 'A Sovereign'.

publicActorTag (S211 · D-S210.1)

DISCRIMINATES

Held-spam signal boundary (isHeldSignal)

✓ caught the probe ✓ passed the control

Catches: a quarantined / gate-rejected spam signal — withheld from the Record.

Passes: a substantive, honest signal — which MUST reach the Record, not be silently swallowed.

signalBoundary.isHeldSignal (S214)

DISCRIMINATES

Denial-receipt boundary (publicDenialReceiptView)

✓ caught the probe ✓ passed the control

Catches: the crossing actor's raw id on the public audit ledger.

Passes: the hash-chain fields (payload_hash, prev_receipt_hash) — untouched, so the auditor keeps verifiability.

publicDenialReceiptView (S221 · D-S236.1)

DISCRIMINATES

Whisper receipt boundary (publicReceiptView)

✓ caught the probe ✓ passed the control

Catches: a Steward's private note on a whisper-linked receipt.

Passes: an ordinary non-whisper receipt — through UNCHANGED (zero-copy fast path).

publicReceiptView / isWhisperLinkedReceipt (S204)

DISCRIMINATES

Archive-event visibility (isPublicArchiveEvent)

✓ caught the probe ✓ passed the control

Catches: a whisper / non-public archive event — kept off every public timeline.

Passes: an explicitly public event — which MUST appear (a guard that hid everything would erase the Record).

isPublicArchiveEvent (S203)

DISCRIMINATES

Confluence slug boundary (redactActorFields roots-strip)

✓ caught the probe ✓ passed the control

Catches: two conveners' crossing callsigns (bare slugRoots) on a confluence surface.

Passes: the derived agent/human SHAPE (kinds) the narrators need — preserved, not destroyed.

redactActorFields roots/confluence_key strip (S225 · S229)

DISCRIMINATES

Request-provenance boundary (crossOriginRequest)

✓ caught the probe ✓ passed the control

Catches: a provably cross-site credential request — a login-CSRF forgery that would mint a Sovereign Key into a victim's browser.

Passes: the organism's OWN same-origin form, and a header-less request an older browser sends on a legitimate same-origin POST — the guard refuses the forgery WITHOUT breaking the recovery flow it protects.

crossOriginRequest / requireSameOrigin (S241 · D-S241.2)

DISCRIMINATES

Navigation-capability boundary (localNavigationTarget)

✓ caught the probe ✓ passed the control

Catches: a path-shaped backslash authority which browsers resolve off-origin.

Passes: a genuine local path, query, and fragment — preserved without destroying useful navigation state.

localNavigationTarget (S248 · D-S248.1)

DISCRIMINATES

Failure-projection boundary (publicFailureReason)

✓ caught the probe ✓ passed the control

Catches: a payment provider's or a runtime's own sentence — text the organism did not author — heading for a public failure response with an identifier inside it.

Passes: the DISTINCTION between failure classes. This is the guard most at risk of the redact-everything lie: a classifier that returned one constant for every input would satisfy the Boundary Census's membership check perfectly while destroying every scrap of diagnostic signal a visitor or an operator has.

publicFailureReason (S246 · D-S246.1)

Why prove BOTH directions

A guard that redacts EVERYTHING is as dishonest as one that redacts nothing: it destroys legitimate signal and trains its readers to ignore it. The Boundary Census proves each guard CATCHES a bad input; this proves each also PASSES a clean one — that it discriminates. Each guard reads `discriminates` only when both probes held on this render, so a guard collapsed to always-true or always-false surfaces here — publicly — before a reader has to wonder whether a green means safe or asleep.

every probe is a synthetic literal; no real actor id, name, receipt, or body is read or shown — the census proves each guard discriminates WITHOUT exercising it on anyone real

Machine census (JSON) → · The Boundary Census → · The Abstention Ledger →