ESTATE.md was still the 2026-07-22 snapshot (13 leaves, v0.9, 'SLH-DSA
NOT in the log'); llms.txt still said thirteen leaves, 23 pages, and
linked the retired /paper/v0.x routes; README repeated the stdlib-only
verify.py trap the site just fixed; evidence/README called the July
capture's 16/16 attestations 'definitive' and its 8-leaf state current.
All brought to truth. Entry numbering standardized on 0-based leaf
index with 'the thirteenth entry' as the ordinal gloss (docs, lab
manual, security note, mirror README template). Operator-machine path
removed from provider/README.
Audit question: is the documentation coherent, and is the app portable
to a fresh machine (macOS) with proper isolation? Findings and fixes:
- README never mentioned the cockpit/deck/lab manual (three rounds of UI
evolution invisible at the front door). Added: human-surface section
with the one command, expanded Install (editable-from-clone is the
supported mode — repo files are part of the product; zero-install
PYTHONPATH=src alternative; fresh-machine skip behavior), macOS
openssl/LibreSSL Ed25519 prerequisite with a one-line self-check,
wallet commands in the command list.
- The lab manual violated the repo's own macOS law (AGENTS.md): GNU
sha256sum -> shasum -a 256; GNU sed -i -> portable python3 -c
one-liner (executed and output-matched before shipping: entry 0 hash
mismatch, BROKEN, exit 1).
- Fresh-clone bootstrap was actually tested end to end in a scratch
clone: zero-install suite 130 passed / 0 failed / 14 skipped after
fixing the one unguarded test (test_ledger_is_hash_chained now skips
like its siblings when the dogfood binary is absent - capability gap,
not failure); venv + pip install -e . -> pacta console script serves
bridge/deck/manual/sample-prefill/drift-tripwire with no PYTHONPATH.
- PYTHONPATH incantations simplified: cockpit needs src only (provider
never imported by src/pacta); manual + cockpit.md updated.
- threat-model.md: cockpit attack-surface note (no mutating routes,
no auth because nothing to operate, localhost-only disclosure risk,
probe-only network I/O, fake-cockpit = host-compromise boundary).
- products.md: cockpit named as the shared human surface of all four
profiles. AGENTS.md: doc-portability law + the cockpit's three laws
added to the standing guidance.
Suite 144 green here; 130/0/14 on a bare clone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator asked for a real big fat user manual: read on one monitor with
the deck on the other, worked like a lab from beginning to end, with
highest didactical skill — the goal being to educate ONE person in ALL
roles, as if to BECOME each role. Shipped as a full course:
- docs/warden-lab-manual.md (canonical, ~7100 words): 8 sessions +
capstone. Fixed didactic ritual per role-session: why the role exists
-> the mind of the role -> concepts -> LAB (numbered machine exercises
with checkpoint rails) -> never-list with whys + thought experiment ->
handoff artifact -> self-test -> recap card. Notation: do / checkpoint
/ write / optional. Capstone 'incident day': one incident walked
through all six chairs producing seven written artifacts; graduation
session maps the path to a real wallet; Appendix A command reference
by chair, Appendix B full self-test answers.
- Session 4's tamper drill: copy the demo wallet, flip one character of
ledger history, watch verify-ledger AND a second cockpit catch it.
Every checkpoint in the manual was executed by the author before
commit: status fields, intact-chain exit 0, tampered-chain 'entry 0:
hash mismatch / BROKEN' exit 1, CUSTODY EVIDENCE BROKEN banner.
- src/pacta/mdlite.py: deliberately small stdlib Markdown renderer
(headings/anchors+TOC, bold/italic/code with placeholder stashing,
fences, lists, quotes, tables, links); tested against the real manual
for zero artifact leaks.
- /manual route with syllabus TOC; manual typography (checkpoint boxes,
session borders); nav tab, deck wizard cross-link, cli hint.
Suite 142 -> 144 green; read-only sweep covers /manual.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
