What the build refuses

This site makes claims about itself: that it contacts nothing, that vault content is republished byte for byte, that every figure is generated rather than typed.

Thirty-two checks turn those from sentences into facts. The build fails; the release does not ship.

What makes the list worth reading is that almost every entry has a story, and the story is usually that we got it wrong first.

Reading sgit.ai's guidance turned up the rule this site was breaking:

On a *.sgit.ai page there is no host — you are the host — and the bytes you render were written by whoever holds the vault's write key. A vault must be able to change what is shown, and never what the page does.

A <script> in a pack file became a real script tag and executed. So did <img src=x onerror=…>. Confirmed in a browser, not reasoned about.

Republished vault files render in an untrusted mode: raw HTML escaped, no shortcodes — a vault file must not mint a claim chip either — and links restricted to http, https, mailto, a relative path or a fragment.

A markdown link was the second vector: [x](javascript:…) minted a live javascript: href.

check_no_vault_markup reads the built pages rather than trusting the flag was set.

The first version of that gate flagged this, in a page that was working correctly:

<img src=x onerror="…">

That is the escaper doing its job — inert text, not markup. A gate that fires on its own fix teaches the next person to loosen the fix until the gate goes quiet.

Every pattern now requires a real < or a real attribute.

Two paths carry every republished file — the raw copy and the twin beside its rendered page — and both are hash-checked against the vault.

Change either and the build stops and names it.

A correction belongs in the vault. Making it on the site would leave two documents that disagree and no way to tell which is the source.

The PDFs are generated by a browser and committed, because CI has no browser and a deck nobody can download is not the point.

That makes staleness the risk — so data/deck-pdfs.json records the sha256 of the deck each PDF was printed from, not of the PDF alone.

Move the words, and the build demands the PDF be reprinted.

— in a page's lead shipped as six literal characters. Markdown escapes the ampersand first, so the reader sees — rather than a dash.

It went out in v0.1.14 and was caught in a screenshot, not by a check. The build was perfectly happy.

The check that now catches it caught four more of mine within the hour.

Record the commit. A version that does not name the commit it was built from cannot be verified later.

sgit.ai/docs/guidance

Eighteen releases, eighteen commits. The gate refused this very release when it had none — which is how the workflow's own flaw was found.

A credential scan built for sgit shapes will not catch other secrets. We nearly published an OpenRouter key sitting in a vault file, in a field called openrouter_key, that matched none of the sgit patterns.

Seventeen patterns now, including one that matches a credential named by its field rather than by a known prefix.

The first version of that pattern did not catch openrouter_key either — the anecdote repeating itself inside the fix for the anecdote. Caught by testing it against the case.

No check proves a site is correct. Thirty-two of them prove that thirty-two specific things that once went wrong cannot go wrong silently again.

The defects that shipped were found by reading the guidance, driving a browser, parsing a table with a script, and looking at a screenshot — not by the checks.

Checks are memory, not judgement. They stop you making the same mistake twice; they have never once found a new one.