Proof

Last conformance run

217 checks passed · 2026-11-09 02:12Z · deployment nr2-20261109-021233-461a440b

Every check the deploy gate ran against this exact build. It blocks the ship when it fails.

• PASS declarations present — 10 file(s) in public/agents
• PASS brand.json is the one place a name lives: site, origin, entity, five ring labels and tints, the one door, the two bars, no siblings, the wordmark — osact.com · Not Rest Inc. · door https://osact.ai
• PASS parse chat.json
• PASS parse concierge.json
• PASS parse field.json
• PASS parse index.json
• PASS parse ring-capabilities.json
• PASS parse ring-company.json
• PASS parse ring-philosophy.json
• PASS parse ring-platform.json
• PASS parse ring-projects.json
• PASS parse site.json
• PASS required fields chat.json
• PASS degree_of_agency chat.json — adaptive
• PASS prohibited effects chat.json
• PASS id matches filename chat.json — id=chat
• PASS required fields concierge.json
• PASS degree_of_agency concierge.json — deterministic
• PASS prohibited effects concierge.json
• PASS id matches filename concierge.json — id=concierge
• PASS required fields field.json
• PASS degree_of_agency field.json — deterministic
• PASS prohibited effects field.json
• PASS id matches filename field.json — id=field
• PASS required fields index.json
• PASS degree_of_agency index.json — deterministic
• PASS prohibited effects index.json
• PASS id matches filename index.json — id=index
• PASS required fields ring-capabilities.json
• PASS degree_of_agency ring-capabilities.json — deterministic
• PASS prohibited effects ring-capabilities.json
• PASS id matches filename ring-capabilities.json — id=ring-capabilities
• PASS required fields ring-company.json
• PASS degree_of_agency ring-company.json — deterministic
• PASS prohibited effects ring-company.json
• PASS id matches filename ring-company.json — id=ring-company
• PASS required fields ring-philosophy.json
• PASS degree_of_agency ring-philosophy.json — deterministic
• PASS prohibited effects ring-philosophy.json
• PASS id matches filename ring-philosophy.json — id=ring-philosophy
• PASS required fields ring-platform.json
• PASS degree_of_agency ring-platform.json — deterministic
• PASS prohibited effects ring-platform.json
• PASS id matches filename ring-platform.json — id=ring-platform
• PASS required fields ring-projects.json
• PASS degree_of_agency ring-projects.json — deterministic
• PASS prohibited effects ring-projects.json
• PASS id matches filename ring-projects.json — id=ring-projects
• PASS required fields site.json
• PASS degree_of_agency site.json — deterministic
• PASS prohibited effects site.json
• PASS id matches filename site.json — id=site
• PASS every declaration's owner is brand.json's entity, and its site is brand.json's site — 10 declarations · owner Not Rest Inc. · site osact.com
• PASS constituents <-> declaration files 1:1
• PASS agent roster is the nine proportionate agents — chat, concierge, field, ring-capabilities, ring-company, ring-philosophy, ring-platform, ring-projects, site
• PASS index.json carries the site-level purpose
• PASS concierge approval_required includes send-email
• PASS concierge prohibits autonomous-outbound
• PASS concierge prohibits send-email
• PASS chat declares adaptive agency
• PASS chat pins the model id — claude-haiku-5-5
• PASS chat pins adaptive thinking at low effort — thinking "adaptive", effort "low"
• PASS chat declares no temperature (Haiku 5.5 omits sampling parameters)
• PASS chat reaches only the owner's agent host — https://agent.not.rest
• PASS chat prohibits training, persistence, sending
• PASS chat states where the words go
• PASS same-origin links resolve chat.json
• PASS same-origin links resolve concierge.json
• PASS same-origin links resolve field.json
• PASS same-origin links resolve index.json
• PASS same-origin links resolve ring-capabilities.json
• PASS same-origin links resolve ring-company.json
• PASS same-origin links resolve ring-philosophy.json
• PASS same-origin links resolve ring-platform.json
• PASS same-origin links resolve ring-projects.json
• PASS same-origin links resolve site.json
• PASS capital-state.json parses
• PASS capital state is a known state — NO_OFFERING
• PASS NO_OFFERING language clean capital.html
• PASS NO_OFFERING language clean capital/evidence.html
• PASS NO_OFFERING language clean capital/exists.html
• PASS NO_OFFERING language clean capital/participate.html
• PASS NO_OFFERING language clean capital/progress.html
• PASS NO_OFFERING language clean capital/questions.html
• PASS NO_OFFERING language clean capital/system.html
• PASS kernel functions present — _middleware.js, access.js, capsule.js, intent.js, journal.js, pulse.js, receipts.js
• PASS intent.js present
• PASS intent.js has no outbound mail path — forbids sendmail/smtp/resend/sendgrid
• PASS intent.js exposes NR2_INTENT_RULES
• PASS intent.js composes drafts kernel-side
• PASS intent.js declares NR2_INTENT_URLS
• PASS intent.js carries no wing origins, catalogs, resolvers or sibling items (the wings are absent) — NR2_INTENT_URLS is the kernel's only naming
• PASS every URL literal in intent.js comes from NR2_INTENT_URLS
• PASS intent.js builds no URL at runtime
• PASS adaptive path is gated while concierge declares deterministic — declaration and code must move together
• PASS pulse.js present
• PASS pulse.js reaches only brand.json's door: its record is brand.json byte for byte, it spells no other URL and no .rest host — door osact.ai
• PASS only pulse.js reaches another origin
• PASS intent.js fetches nothing (its one same-origin read left with the wing catalogs) — 0 fetch site(s)
• PASS pulse.js has exactly one fetch call site — 1 found
• PASS us.not.rest is named nowhere the field ships from (index.html, functions, declarations) — 18 files scanned
• PASS the pulse has exactly one sibling — brand.json's door, on the red ring — and no .rest host — sibling: osact.ai
• PASS no function sets a cookie header
• PASS journal.js writes only to the JOURNAL binding — JOURNAL
• PASS receipts.js writes only to the JOURNAL binding — JOURNAL
• PASS capsule.js writes only to the JOURNAL binding — JOURNAL
• PASS journal.js sets event time server-side (NR2_SERVER_TIME) — Date.now(), // NR2_SERVER_TIME — event time is server-set; a client cloc
• PASS journal.js bounds its replay with LIMIT 500
• PASS receipts.js bounds its read with LIMIT 200
• PASS middleware fails open on any exception
• PASS middleware sets cache-control no-store on /api/*
• PASS index.html carries the agentic-ui marker class
• PASS index.html carries the nr2-swarm marker
• PASS index.html does not touch document.cookie
• PASS site declares the visit-memory store
• PASS site declares storage-write
• PASS site forbids persisting visitor text
• PASS visit memory is declared on-device — localStorage / visitor-device
• PASS visit memory declares it never records visitor text
• PASS site declares the per-tab visit marker — sessionStorage / nr2-visit
• PASS localStorage is used only under declared keys, and the chat zoom is one of them — nr2-zoom vs nr2-zoom — 8 uses
• PASS the chat zoom scales the frame, never the type inside the blob's document — one factor on the published scale, no type touched
• PASS sessionStorage is used only for the declared tab marker — nr2-visit — 3 uses, 3 keyed
• PASS field still prohibits storage-write
• PASS index.html carries the visit-memory harvest
• PASS visit memory harvests outcomes, never words
• PASS the visit-memory key is used only for localStorage — 5 uses, 4 storage
• PASS the spine carries a forget control
• PASS the whisper context function ships
• PASS the whisper hands the service no sibling doors and no wing sentences — visit memory only, and the declaration says so — leaves_device: only as the clamped whisper context handed to chat: counts a…
• PASS index.html loads no third-party script
• PASS the /about rule is guarded to the site itself, in both mirrors, off one list of names — 9 names, both matchers honour the guard
• PASS every page-and-walk name rule is guarded against questions, in both mirrors, off one vocabulary — 21 rules each side
• PASS a route into the walk the visitor is already in stays put, and only the restart words rewind it — 22 stops, all in PAGE_URLS
• PASS the executor has no wing branch: an open's first step is the page-table lookup, and no wing normaliser or receipt remains — open -> safeUrl -> __nr2SlugFor, nothing between
• PASS the conductor's two escapes go through one give-up, and it is the one plain navigation (no wing hand-back) — 1 plain navigation
• PASS the own-page link is a real anchor the visitor presses, and nothing in the field presses it — anchor, rel, journal effect, no scripted click, declared on ring-platform
• PASS intent tables found in both mirrors
• PASS intent tables agree on rule count — front 42 / kernel 42
• PASS intent tables agree on trigger vocabulary
• PASS the hand-off constants in index.html are /handoff.json's own (contract v1.3), byte for byte; the child is brand.json's door and this site's origins are among its parents — https://osact.ai ↔ https://not.rest + https://www.not.rest + https://osact.com + https://www.osact.com
• PASS the hand-off channel takes only the door's own frame and type, and posts only to that origin — 1 postMessage site, origin + source + type filtered, literals only in the constants
• PASS nr2=handoff rides only the door's frame, never the page's own url or another file — decided by origin; the own-page link and pageView keep the plain url
• PASS the hand-off travel is BRANCHED off at rest: no door, no state (never h = 0), the original arithmetic — turbulence, centre/radius, pointer and labels each branch; one writer publishes null at h 0
• PASS ring-platform.json declares the hand-off channel honestly, and the hand-off code stores and fetches nothing — origin https://osact.ai, donotrest.handoff in / nr2.handoff out, storage false
• PASS the wait for `ready` has no clock (v1.1); a load error or a throw is today's door; reduced motion never travels — no timeout, error + throw fall back, still = cross-fade, ready acted on only while opening
• PASS the full-stage door stays under the chat, masthead and spine, takes no press before `reveal`, and keeps a way back — z stays .nr2-pageview's 8; presses only on is-live, set only by the reveal; the way back is a button
• PASS the door never conducts, never stabilizes and never sets pageExpand: its travel is the one motion — conductor bypass, admitted from any state, marker "handoff", pageExpand reads only "true"
• PASS the two hand-off bars are solid and plain — one opaque fill, a centred mono label, nothing that glows or fades at the edge — above the frame and the chat — bars z 32 over frame 8 and chat 31
• PASS the door's frame sits between the bars (inset by their own height), and the child's pose is mapped by the frame's box — top and bottom inset by --nr2-hbar; ready's cx/cy shifted by the frame's offset
• PASS the way out is a real anchor the visitor presses (this tab, the door url), the only navigation the hand-off surface makes, declared — an <a> with the plain door url, no target, no scripted click, journalled open-own-page; the module navigates nowhere
• PASS the way back is the top bar — a button reading brand.json's `bars.back` (↑ osact.com), that runs the return; Escape too — button, label, the return, Escape
• PASS the red ring carries one door, brand.json's osact.ai, wired in every table (label, word, both intent mirrors), and no dropped door is wired anywhere — declaration, 5 door tables, rule 5 both sides → https://osact.ai
• PASS 404.html present (SPA-fallback killed)
• PASS 404.html identifies itself (as brand.json's site)
• PASS 404.html routes back to the site map
• PASS sitemap does not list the 404 page
• PASS chat page present at /chat/
• PASS chat page loads only its own /chat/ assets — /chat/assets/fluidui.js?v=6c39b25c
• PASS chat page points at the declared agent host
• PASS chat page hands field routes to the parent
• PASS homepage hosts the blob frame
• PASS homepage exposes the field executor to the blob
• PASS concierge input retired (hidden)
• PASS the part is BRANCHED off when the strands list is closed, and never moves the centre — radius, polyline, unmoved centre and the band's own edge all branch
• PASS __nr2SetPart declines only on impossible geometry, off a hero-measured fixed point the dent never carries a point past — empty box, an already-clear field and a phone decline; the hero sets the fixed point and the clamp holds it
• PASS the masthead (the strands), the spine and the chat zoom outrank the chat frame, so a press on them is theirs — chat 31, masthead 33, spine toggle 33, spine 40, zoom 33
• PASS the chat zoom is placed under the blob's mark, centred on the mark it measures — centre from the mark's own box, centred by transform, measured only at rest
• PASS no wing catalog, doors file or catalog builder ships (public/wings/, tools/build_wings.py) — absent
• PASS nothing in the front reads a wing catalog or a doors file — no reader
• PASS deploy.sh refreshes no wing catalog and probes no sibling origin — no catalog refresh, no frameability probe
• PASS the field has no parametrised door: a cross-origin page opens only from a PAGE_URLS entry — no transient slot, no origin allowlist
• PASS the amber ring is the OSACT products as pages of this site — declared same-origin, wired on ring 0, opened in-field — /products · /browser · /os · /web · /lmnia · /ifendo
• PASS the part journals only doctrine kinds — result, dispose
• PASS the strands list is text at the spine's width, arrow on the left — svg gone true, width min(180px,60vw) vs spine min(180px,60vw), link true
• PASS generator.html present
• PASS generator loads only its own first-party module — /generator/design-slides.mjs
• PASS generator touches no cookie or storage
• PASS generator page carries the mark
• PASS generator module present under public/generator/
• PASS generator module reaches no network
• PASS generator module marks every slide Not Rest Inc.
• PASS generator module is byte-identical to the vendored copy (site/vendor/learn, its MANIFEST's sha256) — 100437 bytes, sha256 dd7612d2f755…
• PASS the vendored learn set is exactly its MANIFEST: every file's sha256, the 20 designs, the module's 17 families — 22 files, 20 designs, families 17 (title loop bands tree timeline grid rows categories ladder clusters toolcard hookcard sequence packet twoframe steps three)
• PASS the workshop tour is seven stops, coloured W·M·B·M·W·M·B in its rings and its stop list, each page paging to its neighbours and stamped i of 7 — 7 stops, W·M·B·M·W·M·B
• PASS the workshop's learn stop is gone — no page, no slug, no link, no sitemap entry; the strands line says seven stops — absent everywhere
• PASS every designed figure in the workshop is its vendored design with the one declared recolour (the generator's pink → brand.json's red), on the pages the MANIFEST lists — 16 figures on 5 pages
• PASS wrangler.toml targets osact.com's own resources — Pages project osact, D1 osact-journal, KV osact_pulse — and names nothing of not.rest's — osact · osact-journal 4103c9a5… · osact_pulse bf9ee74b…
• PASS deploy.sh uploads only to the osact project (exit 3 otherwise), with the pinned wrangler (exit 5 without npm ci), and verifies the build live by content markers on pages.dev and brand.json's origin — pinned to osact; verified on osact.pages.dev + https://osact.com
• PASS the journal migration carries every table and column the kernel's SQL uses (each statement prepared on it; every kind × effect class inserts) — 27 statements from 8 kernel files prepared on 0001_journal.sql + 0002_access.sql + 0003_access_retention.sql + 0004_waitlist.sql + 0005_waitlist_mail.sql
• PASS the waitlist endpoint keeps the interface sheet's contract: POST only, same-origin, every attempt counted before validation, the seven error codes (BUSY, never RATE_LIMITED), the five products, 5 per client and 30 per network an hour with no site-wide cap, 503 never a stack, only JOURNAL and its two secrets, salted hashes never the IP — 7 codes · env ACCESS_SALT, INVITE_CODES, JOURNAL, MAILER
• PASS the waitlist endpoint holds the refuter's repairs (OW3b/OW4): one guarded client statement and a fixed network place, IPv6 by its /64 and /48, no site-wide cap and a valid code past a busy network, the salt required (503 without it), invisible characters refused, the bounded purge on every write, the no-script page uncounted, no client hash on the waitlist, invitations never downgraded — F1 F2 F3 F4 F6 F7 P4 N1 held
• PASS the honeypot: a field no person sees on every waitlist form, sent with every join, answered like a person (200 listed) before the store is touched — nr2_ref (sent as website) → 200 listed, nothing stored, on 6 forms
• PASS site.json declares the waitlist write: waitlist-write on the visitor's press, its store and products, what it keeps and never keeps, the limits, invitations, 12 months, the one exception to persistence-of-visitor-text — /api/access, on the press
• PASS privacy.html carries the Waitlists section — what is stored, why, 12 months or deletion on request, no list, no sharing, the hashes kept apart and deleted at a day, the two limits — and says the one form is the waitlist — #waitlists
• PASS the waitlist forms talk only to /api/access — six forms, one first-party script with one same-origin fetch, the field wiring a framed product page's form, no form host or tracker, nothing kept on the device, and without JavaScript the page says where to write — one fetch, same origin; no script → the mailto line
• PASS the hero is by invitation with a waitlist per product: the kicker, "By invitation.", the waitlist line, five unchosen chips, one email field, the join action, the code reveal, a one-field waitlist on each product page, the after-states and BUSY — no request-an-invitation wording, no hype — restraint holds
• PASS the waitlist store has one writer: no other file at any depth under functions/ names the store (split names included), no function calls exec(), reaches the database by bracket or decodes a name, every prepared SQL is a literal, and no _worker.js stands in for the functions — 8 function files read; access.js alone
• PASS nothing under public/ sends to another origin: every form and formaction is this site's own path, every fetch/beacon/request names one, no protocol-relative URL, no image beacon, no XHR or socket — and the chat build (read, never edited) posts no form elsewhere and names only its brain — 71 pages and scripts read, plus 4 in chat/
• PASS every page carries the Content-Security-Policy (N4's runtime backstop): connect-src this site + the chat's brain, form-action this site, frame-src this site + the one door, frame-ancestors this site, images and scripts this site, no wildcard, no eval — word for word, in any header case, and the same policy on every /api answer — 13 directives
• PASS the joiner's confirmation is sent after the answer and only for a new row: one waitUntil call, one budget per normalised mailbox (1 per 24 h, 3 per 30 days, never again once removed) and 300 attempts a day site-wide (atomic), a bare addr-spec only, a 32-byte removal token in the link's fragment stored only as its SHA-256, single use, 365 days, a GET that never acts, a POST that suppresses the mailbox and deletes the address's rows in one transaction — waitUntil · mailbox 1/24 h 3/30 d · suppressed · 300 attempts · sha256 · #t= · 365 d
• PASS the mailer Worker osact-mailer has no public URL, sends only from [email protected] (the digest only to [email protected], daily at 15:00 UTC, once per UTC day, counted by SQL aggregates), reads the waitlist and writes only its own two ledgers, refuses a suppressed mailbox and a second send to one mailbox in 24 h on its own, never sees an invitation code, the site reaches it only by the MAILER service binding — and its copy renders the sheet's words, one removal link, no image, and no digest on an empty day — 11 statements; copy rendered
• PASS the mailer refuses every send without its own ACCESS_SALT of 32+ characters (503, before any ledger is read or anything is sent) and computes the suppression key from it itself (a Worker secret, never a var) — 503 without a salt; key computed by the mailer
• PASS one canonical-domain validator (site/shared/domain.js) serves the site and the mailer: a trailing dot, a double dot, an IP literal, a non-ASCII character, a bad label or a single-label host is INVALID_EMAIL (no IDN in the waitlist), and the deploy stage carries the module — validator shared; deploy stages shared/
• PASS site.json declares the two mails (the visitor's confirmation on their press, the owner's digest) and the removal path, send-email stays prohibited, and privacy.html says what is sent, from whom, the removal link, and that nothing else is sent until a place opens — #waitlist-mail
• PASS the OW4 refuter's follow-ups hold: invitation codes shorter than 16 characters are ignored (W1); the export quotes every field, defuses a formula after every separator and never exports the code (W3); wrangler is pinned by site/package.json and its lockfile, and the README, the tool and the mailer call npx --no-install (P11) — wrangler 4.158.0
• PASS privacy.html carries the Text messages heading and the no-sharing sentence — heading true, sentence true
• PASS terms.html carries the SMS terms heading, the rates line and the STOP line — heading true, rates true, stop true
• PASS contact.html carries the number: visible text, tel: and sms: links — tel true, sms true, visible true
• PASS index.html's Organization JSON-LD parses and carries the telephone — blocks 1, parse true, organization true, telephone +1-949-402-0404
• PASS contact.html's Call or text block publishes the number and the text-message CTA disclosures, visibly, with privacy and terms links — block true, tel true, sms true, number true, consent sentence true, missing phrases [], privacy true, terms true, uncollapsed true
• PASS privacy, walk/ask and agents/index.json say no "own machine" or "own model", and privacy's Text messages section carries the approved model sentence — own-claim files [], section true, approved sentence true
• PASS no .rest host anywhere under public/ or in the kernel, except the declared exceptions (chat.json, the contract's parents, the campaign block, the vendored generator module) — 95 files scanned; exceptions carrying a .rest host: public/agents/chat.json, public/generator/design-slides.mjs, public/handoff.json + contact's Call-or-text block + the NR2_HANDOFF line
• PASS index.html carries brand.json byte for byte as #nr2-brand, and its code reads the record from there — inlined record = brand.json
• PASS every page carries brand.json's name — title suffix, canonical origin, wordmark — and the sitemap, robots and manifest agree — 67 pages, 66 sitemap locs
• PASS the entity stays Not Rest Inc. — every copyright line, and legalName in the three JSON-LD blocks (whose name and url are brand.json's) — © Not Rest Inc. 2026 · legalName Not Rest Inc. ×3
• PASS the rings read brand.json: the engine's colours, the pager's colours, the red token and the five eyebrows — red #ef5a55; PRODUCTS · OSACTAPPLIED · CAPABILITIES · PHILOSOPHY · COMPANY
• SKIP staged /proof checks (no NR2_STAGE — not a deploy)