docs: record the real state, including what we cannot see

[attu308]

The v1 wrap-up left this repository accurate about what works and silent about what it is unable to observe. This writes the second half down. Documentation only — no source changes.

What's new

README gains a "What we cannot see" section, deliberately separate from "does not work". That list is about features; this one is about the verification apparatus, and a gap in the second is what let a red build sit under the v1.0.0 release for eight days. docs/PREMISES.md P8 already argued that every falsification of "the gate is the definition of does this pass" arrives by absence rather than failure — and an absence nobody has written down is indistinguishable from an all-clear. So they are now enumerated:

• install.ps1 has never been executed by anything, ever. install.sh gets a real run against a throwaway tree (scripts/verify_install.sh); the PowerShell installer is only ever read — audit_system.py greps it for strings, test_installer_parity.py ratchets its structure. Every Windows install defect so far (W1–W5, W8) was found by a person on a real machine. Assume the next one will be too.
• The repository cannot read its own CI without gh on the PATH. The fix is known — a REST fallback — and is not made here. Naming a gap is not closing it.
• A branch gets no CI at all. The workflow triggers on push to main and on pull requests only.
• The local gate is one OS and one interpreter against CI's nine legs. Three platform-specific defects have now slipped it: cp1252 encoding (2.9), CRLF line endings (V1), wall-clock resolution (V2).
• docker-compose.test.yml has still never run.

docs/PREMISES.md gains P10 — the privacy paradox. Routing a prompt to a peer's machine breaks the "nothing leaves hardware I own" property that motivates local inference. P6 constrains what this code persists and says nothing about where a prompt travels; the two get conflated. The desk review surfaced it on 2026-08-14 and the file recorded that it "belongs here" while not putting it here — three days in which the register's own argument applied to itself. Its falsifier does not fire for a self-hosted fleet (D6), only for the cross-party pooling the review identified as the one surviving differentiator — which now rests on two low-confidence premises at once (P2 and P10).

VERIFY.md's known-hits table said the auth-bypass grep returns one hit. It returns three. The two extra are comments describing bypasses being prevented, and both predate this change — so the code was fine and the list was wrong, which is worse than it sounds: the instruction beside it is to check every hit against the list, and a list stale by two trains you to skim. Also recorded: the private-key grep matches VERIFY.md itself, because VERIFY.md quotes the fixture it documents.

README and ROADMAP now state that v1.0.0 shipped over a red CI run, that its tag is deliberately not moved (moving it would silently change the bytes its published release hands out), and that v1.0.1 is the first release whose commit CI has passed on every supported platform.

STATUS.md regenerated against a clean tree. The version on main described a working tree that no longer existed — last commit b31fce3 while main was two ahead, branch set to a feature branch, and "8 uncommitted change(s)" listing edits since committed. Fixing that in the same PR that criticises it seemed like the cheapest possible place to practise it.

One honest seam, left in place and labelled

README claims CI is green while STATUS.md says UNVERIFIABLE. Both are correct — the claim comes from reading the run through the API, STATUS.md reports what it can ask for without gh. README now says so, rather than letting a reader catch two files disagreeing and trust neither.

Verification

Local gate: PASS 28 checks, 906 tests, clean tree at 9ebaddd. One check did not run: compile under python3.14, not installed here — CI covers it.

Not addressed, and not claimed: ROADMAP 1.5, a node serving a request across a real NAT. Still the one functional gap in v1; still needs a second physical machine on a separate network.

---

Generated by Claude Code