Scan the role that matches the shape of your problem, then read the tool underneath it. Each links to its own page; every tool here is free, MIT-licensed, and has zero required dependencies beyond what its Stack names.
A callsign is a memorable, SAFE identifier — not a guaranteed-unique one. The hash makes an accidental collision astronomically unlikely, but “unlikely” is not “impossible”: if your correctness depends on uniqueness, pair a callsign with a real uniqueness source (a timestamp, a sequence, a registry that rejects duplicates). It buys memorability and paste-safety, not a uniqueness authority.
take it →It's a text scan, not a parser — it finds markers by pattern, so a marker written in a syntax it wasn't told about is a marker it won't see. You define the patterns; their completeness is your call.
take it →csv-source emits STRING values only — it never infers types (numbers, booleans, and null stay as their text), never trims unquoted whitespace, and fails closed on a ragged row rather than padding it. A duplicate or empty header name, an unterminated quote, or a bad delimiter is refused (exit 2). A parser you can pin, not a comma-split you have to babysit.
take it →It SAVES a pipeline; it does not VALIDATE it (that's typecheck) and does not RUN it (that's a runner). declare will faithfully write down a score that would not typecheck — it claims only that the pipeline is recorded, never that it is runnable. With --manifest it flags any stage that isn't a declared tool, saving the score anyway and flagging it, never silently dropping a stage.
take it →dir-walk emits a SORTED, portable pre-order stream of {path,name,type,depth,size}. It does NOT follow symlinks (reported, never descended), does NOT emit mtime/ino/mode/uid (unportable, time-varying), does NOT match globs (pipe into a filter gift), and does NOT read file contents (use line-source). The root record is not emitted; its children are depth 1.
take it →fanout splits one input into declared branches; it does not run them, order them by any policy but declared order, or judge whether a branch name is meaningful — it only refuses an undeclared, empty, duplicate, or ill-formed branch.
take it →It reports exactly what git reports — it's only as complete as the history you point it at. A shallow clone gives you a shallow answer, faithfully.
take it →grid-source emits a bounded, stable ROW-MAJOR stream of {row,col} cells (value only under --index/--fill). It is a coordinate SOURCE, not a renderer (pipe --cells into grid-sink to draw), does NOT read stdin (dimensions are flags), does NOT do sparse grids, and does NOT carry data beyond a constant --fill or the row-major --index. Dimensions must be non-negative integers; 0x0 is the empty stream.
take it →ini-source parses sectioned INI text into uniform string records only — it does not coerce types ("8080" stays a string), does not interpolate ${VAR}, does not honor inline comments, and does not process escapes inside quotes. Its own honesty axis: a DUPLICATE key within a section, or a REPEATED [section] header, is REFUSED (exit 2, line-numbered) — never a silent overwrite (the common INI-parser behaviour that changes your data without telling you). A malformed line, an illegal/empty key, or a field-name collision is exit 2. An honest, pinnable parse — not a full INI runtime.
take it →json-source streams the elements of a TOP-LEVEL JSON ARRAY only — a non-array top-level (an object, a number, a string, a boolean, null) or malformed JSON is refused (exit 2) rather than guess how to streamify a single value. Each element is re-serialized to canonical compact JSON, so number tokens and whitespace are normalized (1e3 -> 1000, 1.0 -> 1) though key order is preserved — the JSON value, not the input bytes. It reads JSON, not JSON5/NDJSON, and parses the WHOLE document (not an incremental stream).
take it →kv-source parses PLAIN KEY=VALUE text into uniform string records only — it does not coerce types ("8080" stays a string, never a number), does not interpolate ${VAR}, does not strip an `export ` prefix, does not honor inline comments, and does not process escapes inside quotes. Each of those is a context-dependent guess that would make the same file parse to different bytes across tools. A malformed line (no '='), an illegal/empty key, or --key-field==--value-field is refused (exit 2). An honest, pinnable parse — not a full dotenv runtime.
take it →line-source splits on line terminators (\r\n, \n, \r) and emits one record per line — it does not parse CSV fields (use csv-source), does not parse JSON (lines are verbatim strings), does not read the file itself (you pipe text in), and does not sort or deduplicate. It preserves line bytes (minus the terminator and a leading BOM); with --trim it strips surrounding whitespace, and never otherwise. Empty --field, an unknown option, or a positional argument is refused (exit 2).
take it →The factory declares components; it does not run them. An emitted spec is a validated description, not a live object — turning a spec into behavior is the consumer's job, and this tool makes no claim about whether any downstream runner implements a kind correctly. It guarantees the spec is well-formed and catalog-valid, not that anyone honors it.
take it →It guarantees no reuse within the one ID store you point it at. Two independent stores that don't know about each other can still collide — single source of truth is your job.
take it →ndjson-source reads NDJSON (one JSON value per line) — NOT a JSON array (use json-source) and NOT JSON5. Blank lines are skipped; a malformed line is refused (exit 2) with its 1-based line number, never silently skipped or repaired (dropping a bad record would change your data without telling you). Each value is re-serialized to canonical compact JSON, so number tokens and whitespace are normalized (1e3 -> 1000, 1.0 -> 1) though key order is preserved — the JSON value, not the input line's bytes. So it validates AND normalizes; it reads the WHOLE input, not an incremental stream.
take it →It verifies a declaration is consistent with itself — manifest field vs the tool's own --port flag — not that the declared verb is true of the tool's actual behavior. A tool can honestly declare 'filter' in both places and still behave like a transform in its code; proving a verb against real behavior is a deeper, undecidable-in-general question this tool does not claim to answer.
take it →seq-source emits an INTEGER arithmetic sequence only — it does not do geometric or floating-point sequences (those drift and would not be byte-deterministic), reads no input, and does not randomize. count/start/step must be integers; a non-integer or negative count/start/step, an empty field, or a positional argument is refused (exit 2) rather than emit a drifting or malformed stream. A deterministic generator you can pin, not a fixture you have to store.
take it →
clause-trellis finds contradictions you DECLARED, over a closed set of decidable dimensions (numeric ranges and categorical values). It does not read intent, meaning, tone, or the natural-language text of a clause — if two sentences contradict in spirit but you did not declare the shared dimension, it will not see it. Silence means 'no declared contradiction,' which is necessary, not sufficient. It finds the conflicts you wrote down; it does not understand the prompt.
take it →confessional CONFESSES the constrainable dimensions your prompt left open, from a declared checklist — it cannot find a gap outside that checklist, cannot tell you whether an open dimension matters for your task, and cannot make your prompt complete. It confesses; it does not audit. Its deepest edge: it cannot find the gap you never named.
take it →This is a check, not an immunity — it protects you only when it is RUN, so wire it into a hook or CI rather than trusting a human to remember. And it detects the standard git marker triad; a tool that uses different markers needs a different pattern. Visibility, not immunity.
take it →conform proves STRUCTURE, not TRUTH. A clean pass means every record has the declared fields at the declared types — it is not a certificate that the producer's answer is right, sensible, or what it should have said. It validates the schema YOU declared: declare the wrong schema and it faithfully passes the wrong records. A well-typed lie conforms. Choosing a schema that captures what you actually require is your job.
take it →contract checks STRUCTURE (which fields, at which types), not MEANING. A record that is structurally perfect and semantically nonsense passes — "age": -3 with type number passes, an email that is not an email passes. It makes the declared shape enforceable and names the first record that breaks it; it cannot tell you a structurally-valid value is correct, sensible, in range, or true.
take it →Drops EXACT duplicates (by canonical record, or by one field). NOT fuzzy/near-dedup — no similarity, no value normalization. It does NOT merge the records it drops (keeps the first verbatim, discards the rest), and it keeps FIRST not last — it is not a 'latest wins' upsert.
take it →this checks STALENESS (committed vs a fresh build), not CORRECTNESS: a green means the file matches what the command emits right now, never that the command or its output is right. It runs your build command, so only point it at a command you trust.
take it →gauntlet tests whether a check CATCHES the ONE fault you inject, not whether the check is correct in general: a HELD proves the check fired on this one broken input, never that it catches every fault. It runs your check command, so only point it at a command you trust. It only ever copies the target — it never modifies your original file.
take it →hmac-webhook verifies AUTHENTICITY — nothing more. It is NOT a secret store (you supply the secret; it is never persisted), NOT a replay defender (it proves THIS body is authentic, not that it is fresh — pair it with a timestamp or nonce check for that), NOT a TLS or transport check, NOT an authorization system (authentic is not the same as allowed), and NOT a multi-algorithm negotiator (it verifies the one scheme you name, default sha256).
take it →this normalizes and validates raw input events against a declared schema, folding them into a deterministic typed event stream; it does NOT sanitize application semantics, it does NOT persist, it holds NO clock/network/entropy, and it trusts no event it did not schema.
take it →It validates a DEFINED subset — the colors people actually type. It deliberately does not accept hwb()/lab()/lch()/oklab()/oklch()/color()/color-mix()/relative-color syntax/system colors, and it rejects the CSS-wide keywords inherit/initial/unset/revert (which are not colors). In a browser, CSS.supports('color', str) is the full ground truth; this trades that breadth for a tiny DOM-free core you can read in one sitting.
take it →It keeps 'wrong' and 'unknown' apart: a bad type/range/injection is an ERROR, an unknown field is a dropped WARNING (forward-compat), a missing optional field is silent. The `string` type is NOT stylesheet-sanitized — it type-checks and length-caps only; use `cssvar` (the type with the injection allowlist) for anything headed into a style surface. The named-color allowlist is conservative (unknown names rejected, not guessed) and the cssvar check is a safe-character GRAMMAR, not a full CSS value parser — it proves the value can't break out of a declaration, not that it is meaningful CSS. The schema is YOURS: a malformed schema throws (programmer error); only the config is treated as untrusted and reported-not-thrown.
take it →Selects TOP-LEVEL fields by exact name. NOT nested paths, does NOT rename, does NOT compute or default a missing value, does NOT reorder by content. It selects; it never transforms a value. A requested field a record lacks is simply absent from that record's output — pluck does not invent it.
take it →It checks the witness exists and agrees, never that the witness is the right one. Point it at the wrong file and it'll happily pass — choosing a meaningful witness is your job.
take it →A SUBSET filter over DECLARED windows: it filters on the fields and ranges YOU name — it does not infer a schema, reshape, sort, or de-duplicate. The window tests a value's RANGE, never its truth: a record inside every window passes even if its content is wrong. A --num field holding the string "18" is not the number 18 (a non-number is out, never coerced); an unparseable date value is out; an unparseable bound or MIN>MAX is a startup error, so a typo'd window is loud, not a silently-empty result. Missing a windowed field DROPS the record by default (--keep-missing inverts it).
take it →A SUBSET filter over a DECLARED shape: it filters on the fields and types YOU name — it does not infer a schema from the data, reshape, sort, or de-duplicate. It tests a value's TYPE, never its truth: a record matching every declared type passes even if its values are wrong. The string "5" is not the number 5 (no coercion); 3.5 is a number but not an integer; a required field's absence DROPS the record while an optional field's absence passes; an unknown type is a startup error, so a typo'd shape is loud, not a silently-empty result.
take it →scrub matches KNOWN secret shapes. A clean result means no known shape was found here — it is NOT proof the text is secret-free: a novel token format, a secret split across lines, or a home-rolled scheme passes clean. It is a smoke alarm, not a vault — a hit is real, a clean scan is the absence of a known shape, never a certificate. Because it matches shapes it also flags EXAMPLE secrets (a documented token, its own fixtures) — the honest ceiling working, not a bug; vouch for a line you know is safe with scrub-allow.
take it →It checks that your constraints are consistent WITH EACH OTHER, never that they are the ones you meant. Hand it the wrong constraints and it will faithfully find them consistent — choosing constraints that capture what you actually care about is your job.
take it →It validates the PORT type — can the pipe carry data at all — NOT the RECORD shape. Two tools can both speak JSON-lines so the ports agree, while the records one emits are not the records the other expects; that pipeline typechecks clean here and still fails at runtime. typecheck flags the record-shape layer as unproven and never asserts semantic fit. A slug not in the manifest is reported UNRESOLVED, never guessed.
take it →uniq-filter collapses ADJACENT runs only (O(1) memory) — it does NOT global-dedup (a duplicate not next to its twin is kept), does NOT sort the stream for you, and is NOT fuzzy/near matching. Use dedup-filter for whole-stream first-wins dedup; sort first if your runs are not already adjacent.
take it →FRESH means the byte-truth inputs are unchanged, never that the fact is TRUE (⊢, not ⊨). It re-checks the ground you named — name too few inputs and a real dependency can move without tripping STALE. Byte-truth facts only; live facts (prices, who's CEO) can't be cheaply certified.
take it →weir cuts the flow it can SEE — the command's stdout, line by line. It does not cap the command's own internal resource use (a command that loads 10 GB before its first row is past weir's reach until that row appears), it does not sandbox the command, and a wall-time cut is real but not reproducible — the same input can cut at a different row on a slower machine. It governs flow at the pipe; it does not make your command safe.
take it →
Converts INTEGERS between bases 2-36 (arbitrary precision, no 2**53 cliff). NOT a float/fraction converter (no radix point, no mantissa/exponent), NOT a byte/base64/base58 codec (those encode bytes, not positional radix), and it does NOT parse 0x/0b prefixes or digit-group separators. A digit out of range for the input base, a non-integer record, or a bare number under a non-decimal --from is a hard error, never a silent coercion.
take it →The declarative ruleset covers the ~95% of Markdown whose emission is a flat per-node substitution; it STOPS at `table` (column alignment is logic, not a flat substitution, so a table target needs a code writer) — a table node renders its cells bare and is REPORTED as a hole, never silently mangled. Link safety is universal, not a per-dialect choice: an unsafe href (javascript:, data:, ...) is ALWAYS dropped to its plain-text label, in every dialect. It holds NO clock/network/entropy, persists nothing, and never throws on bad input — an unparseable construct degrades to literal text, an unruled node renders bare and is reported. An external ruleset is validated at load and loud-stops on a structural fault.
take it →doppelganger PROPOSES candidate twins and MEASURES textual divergence, for hardening your own prompt — it does not run your prompt, prove a flip is harmful or that a twin "worked", find a rephrase it has no rule for, or make your prompt safe to ship. A hardening tool, not a jailbreak factory.
take it →It is the deterministic router only: given (entry, reverse, n, k) the exit is a fact, but it does NOT decide when to stop deferring — that judgment (the reversal) is yours. k <= n is a wall (you can't quantize a loop of n ticks into more than n exits); k > n is refused, not rounded.
take it →It reads metadata only — no pixels, thumbnails, or MakerNote (vendor-specific: surfaced as raw bytes, never guessed). It follows IFD0 -> Exif-IFD -> GPS-IFD, not IFD1/interop IFDs. It does not strip or rewrite EXIF, and malformed input throws. GPS is left as raw rational components (GPSLatitude as three rationals + a ref) — it does NOT collapse them into a signed decimal degree, because baking one interpretation into the parser is a presentation choice you should own; compose the decimal yourself.
take it →It sizes to the measure() you inject — only as accurate as your measurer (a webfont still loading measures as its fallback). It searches integer sizes and breaks on whitespace, not hyphens; a single word wider than the box overflows visibly, by design. It computes sizes and lines; the caller renders.
take it →Does the four arithmetic ops (+ - * /) on real intervals. NOT a full interval library — no power/exponent, roots, or transcendental functions (sin/exp/log), no interval union/intersection/hull. NO outward-directed rounding: bounds are plain IEEE-754 doubles (a result whose true endpoint is not exactly representable is the nearest double, which may be a hair inside the guaranteed bound) — for certified soundness use a rational/directed-rounding library. Division by an interval containing zero is refused, not split.
take it →jq-lite implements a SMALL subset of jq — identity, field/index/bracket access, .[] iteration, the pipe, and the ? optional. It has no functions, no arithmetic, no object/array construction, no select/map/comparison, and no recursion (..). For those, use jq itself. A malformed filter or invalid JSON input is refused (exit 2); an unmarked runtime type error is exit 3.
take it →It persists structure, not identity — you supply ids and timestamps; snapshots are base64 (not compressed, not encrypted). It's a layer that hands you strings, not a store: it never touches localStorage, the disk, or the DOM itself.
take it →It reads words, not meaning: a text that names its subject in words no vocabulary lists reads as no kind. On an independent 20-request test set it read 5 exactly, with 2 false hits.
take it →legible is a heuristic, not a verdict, and it detects control-character rubble — NOT wrong encoding. Mojibake (valid bytes, wrong charset) is still printable characters, so it reads `readable` even though no human can read it: a `readable` means “not control-char rubble,” never “correctly decoded.” It does not decode, validate, or understand the text, and never proves it correct or meaningful. It is a gauge you read, never a gate you route on.
take it →A bounded, deliberate Markdown subset — headings, lists, blockquote, fenced code, and inline strong/em/code/link/hard-break — not CommonMark, and small on purpose (tables, nested blockquotes, and footnotes are out of scope by design, not by accident). The browser toDOM emitter of the original it's ported from is left out of this runtime-agnostic standalone; the two shadows shipped are HTML and plain text.
take it →plausible is a HEURISTIC, not a verdict. "Implausible as prose" is not "wrong extraction": code, tables, log lines, base64, URLs, poetry, and non-spaced scripts all read implausible and can be perfectly correct — it flags a smell, you read it. It is language-agnostic BY DESIGN (deliberately weaker than a per-language model), reads SHAPE not intent (plausible prose can still be a prompt injection), and never decodes, corrects, or understands the text. It is a gauge you read, never a gate you route on.
take it →It parses, it does not validate — a message with a missing closing boundary or a header with no body is parsed as far as it reasonably can, never thrown at, so the tree reflects what was there rather than what should have been. Charset support is honest about its scope: utf-8 (full multibyte) and the byte-preserving ascii/iso-8859-1/windows-1252 family decode faithfully; ANY OTHER charset falls back to utf-8 rather than transcoding from native tables — exotic legacy charsets are the edge. An unknown Content-Transfer-Encoding is treated as identity. Header values are RFC-2047-decoded in the `headers` map only; `rawHeaders` keeps the ordered, undecoded originals for anything that must see the wire bytes.
take it →It splits its contract by scale, on purpose: document-level failure (not a PDF, bad input) THROWS like its ratchet-pdf-text twin, but a single malformed value is RECORDED as {malformed, reason} and the walk continues rather than losing the good fields after it — a malformed value is stamped, never returned as clean. It reads the TOP-LEVEL dictionary of each object: a /V or /Contents in a nested sub-dict, or a value inherited through /Kids, is not a target. It resolves an indirect /V one level only. It returns the string as WRITTEN — no /Encoding or /ToUnicode CMap mapping, correct for WinAnsi and honestly wrong for a subsetted CID font. It does not decrypt, decode /ObjStm or xref streams, or repair a broken file.
take it →It returns the string operands as WRITTEN — it does NOT map character codes through a font's /Encoding or /ToUnicode CMap, so it is correct for the common WinAnsi/standard-font case and honestly wrong for a subsetted CID font (glyph-index bytes, not characters). It gives drawn strings in stream order, not a visual reflow — no positional layout or reading-order reconstruction. FlateDecode content is the common case and zlib inflate is not in the browser's zero-dep surface, so a compressed stream is SURFACED as raw bytes and decoded only if you pass an inflate function (Node: zlib.inflateSync; browser: pako) — never faked. It does not decode /ObjStm, xref streams, encryption, or images; malformed input throws.
take it →It reads TEXTUAL metadata only — no pixels, IHDR, palettes, or gamma. It does NOT inflate zTXt / compressed-iTXt on its own (zlib isn't in the browser's dependency-free surface): such records come back with compressed:true, text:null, and their raw compressedText bytes, decoded only if you pass your own inflate function. And it does not repair a bad file — malformed input throws, it never guesses.
take it →It renders in UTC and is a recency label, not a locale-aware or timezone-shifting formatter, and not a full date library. The fixed minute/hour/day/week bands are by design — the value is the refusal to fabricate, not configurable granularity.
take it →Renames TOP-LEVEL fields by exact name, position preserved. NOT nested paths, does NOT select or drop fields, does NOT compute values. A field not in the map passes through untouched. A map whose target name already exists on the record (or is targeted twice) is a REFUSED collision, not an overwrite — the divergence from a last-write-wins merge.
take it →It's a hash, not an HMAC and not encryption — it proves two inputs match, keeps no secret, and is not a password KDF. A from-scratch port for portability, not a hardened crypto library: where a vetted native lib is available and async is fine, prefer it.
take it →It only makes FORCED moves — it reasons, it does not search or backtrack, so a puzzle needing a technique above x-wing returns ceiling-hit (a difficulty read), not a guessed fill. And ‘broken’ fires when reasoning empties a cell; a contradiction sitting between two givens no technique touches reads as ceiling-hit, because the solver reasons about the puzzle rather than front-validating your input.
take it →template fills the {{variables}} your template declares from the record you give it, and refuses (naming the blank) when a required variable is missing; it does not judge whether the filled prompt is correct, meaningful, or safe, and it is not a template language — no logic, loops, or conditionals.
take it →the-oracle makes an assignment reproducible and auditable; it does not make it fair, uniform, or unbiased -- a chosen (seed, moment, n) can skew which variant wins, and reproducing a skewed pick reproduces the skew. It does not run your prompts, call any model, score a variant, or tell you which is better. It decides which variant, reproducibly; it does not decide whether the experiment was sound. Reproducible, not random.
take it →It enforces the topology you declare and records every hop; it does NOT invent routes for you (an unrouted packet is a fault, by design) and its ids are v4-shaped for correlation, not cryptographic (Math.random). request/response is opt-in per bus via { requestResponse: true } — the bus name carries no special meaning.
take it →FLAG, DON'T FAKE: a cross-dimension conversion (metres to kilograms) is a category mistake, not a rounding error — it returns a blank verdict, never a fabricated number. Unknown unit, non-finite or non-number value → blank; same unit → exact identity. It ships the full-precision IEEE-754 double (0 C converts to 31.999...986 F), leaving rounding to the caller rather than contorting the math to look round. Its unit set is a documented closed list, not every unit that exists.
take it →It orders events that share an actor namespace. Two records whose actor sets never overlap read as concurrent by construction — which is correct, but only useful if your actors are named consistently across the stream.
take it →WUPHF renders your message for every channel and counts the cost each imposes — it does not send anything, connect to any service, fire a mailto, or judge whether the words are good; you copy each render and send it yourself.
take it →FLAG, DON'T FAKE: it never guesses a time it does not have. A missing, malformed, or offset-bearing value blanks every field (ok:false); a zoned value with no zone is blanked, never silently floated; an unresolvable home zone is never assumed to be UTC — it proposes the platform's detected zone, else blanks. It converts and re-buckets a stored time; it is not a full calendar library and does not parse arbitrary date formats.
take it →
it proves IDENTITY, not BYTES: a green verify means every sealed file still hashes to what it did at seal time, never that the files are backed up — keep them in git or a zip if you need the bytes themselves. Content-addressed via git-style blob SHAs computed in-process (no git shell-out).
take it →counter-fold is ONE deterministic binary counter incremented N times, its +1 a hand-built ripple carry — NOT a general adder (it adds ONE per step via --steps N; it does not add two counters), NOT a bounded register (it is sparse and unbounded, so it never overflows), and NOT a value printer (it emits the SET of set bits, the counter's state; value = sum of 2**i). The output is the same shape as the input, so it is closed under its own I/O (counter-fold | counter-fold == --steps 2). Fully order-independent — duplicates collapse, output sorted.
take it →It's a text scan with a declared pattern set, not a language parser — a framework or idiom it wasn't told about is a fact it won't see (it fails safe: a real fact left out, never a fabricated one put in). Route/call matching is literal, so a served '/x/:id' and a called '/x/42' are different strings and a live parameterized route can read as headless. Treat headless as 'look here,' not 'delete this.'
take it →The standalone driver is proven in a tree that carries the builders and their helpers; pointed at a bare stranger tree it fails loudly on the missing imports rather than pretending. Full standalone independence is the next build beat — earned against a real foreign fixture, not asserted. The gap is documented in the driver header, not papered over.
take it →Extracted verbatim from compile_recipe_spine.py::compile_spine and proven byte-identical to the compiler's inline logic on all 9 spines (roundtrip_selfhost.py 9/9, including the compiler's own Schematic). The served page documents the fold; the byte-truth is the Python fold + its passing selftest. A full standalone JS port is a later beat — the fold logic is what the fixed-point gate covers.
take it →It's a smell, not a proof — a smoke alarm, not an arson investigator. Great for staleness and homogenization drift; not a data-rot or dead-link checker.
take it →Extracted verbatim from compile_recipe_spine.py::compile_spine and proven byte-identical to the compiler's inline logic on all 9 spines (roundtrip_selfhost.py 9/9, including the compiler's own Schematic). The served page documents the fold; the byte-truth is the Python fold + its passing selftest. A full standalone JS port is a later beat — the fold logic is what the fixed-point gate covers.
take it →histogram-fold COUNTS values into fixed-width buckets — it is NOT density estimation (no smoothing or KDE), NOT a quantile/percentile summary (it keeps no per-value order statistics beyond min and max), and it does NOT choose data-driven ‘nice’ bin edges (that would make a value's bin depend on the whole stream and cost the one-pass property). The output is a JSON aggregate, not a chart: hand it to a plotter, a test, or a diff.
take it →Every hit is a QUESTION, not a verdict — a symbol you renamed or retired reads exactly like one that was reverted away, so hunkhole hands you the finite list and you rule on each. And a clean run is NOT a clean bill: it sees NAMED TOP-LEVEL definitions only, so a hunk reverted inside a surviving function body is invisible to it. Visibility, not immunity.
take it →jsonl-diff compares STRUCTURE, not MEANING. A reported change may be cosmetic (1 vs 1.0, "a,b" vs ["a","b"]) and an unreported match may still be wrong — semantic equivalence it will miss is a difference here. A human reads the diff; the tool only makes the change visible and exact. It tells you two records differ; it cannot tell you the difference matters, is correct, or is safe.
take it →junction merges declared branch-records into one under a declared policy; it does not choose the policy for you, run the branches, or resolve a value conflict the policy leaves ambiguous — it refuses (non-zero exit) when no policy is declared or the policy cannot merge cleanly.
take it →life-fold is ONE Conway B3/S23 step as a fold over a set of live cells, stepped N times in-process — NOT a renderer (it emits the live-cell SET, not a picture), NOT a bounded grid (it is sparse and unbounded, so gliders travel forever), and NOT a variant rule (it is exactly B3/S23). The output is the same shape as the input, so it is closed under its own I/O (life-fold | life-fold == --steps 2). Fully order-independent — duplicates collapse, output sorted.
take it →It renders the TYPE-level map — whether the ports agree so the pipe can carry data at all — not whether the RECORDS fit. A transform emitting {event} records maps clean into a filter expecting {file} records and fails at runtime; map flags that semantic layer as unproven and never asserts it.
take it →merkle-fold proves an ORDERED sequence of leaves is intact — it is NOT a set hash (reorder two leaves and the root changes, which is the point), NOT a signature (it keeps no secret, so anyone with the leaves can recompute the root: it proves integrity, not authorship), and NOT encryption (the leaves are not hidden). A root proves the whole set is intact; a compact inclusion proof for a single leaf is a related but separate tool this gift does not ship.
take it →Extracted verbatim from compile_recipe_spine.py::compile_spine and proven byte-identical to the compiler's inline logic on all 9 spines (roundtrip_selfhost.py 9/9, including the compiler's own Schematic). The served page documents the fold; the byte-truth is the Python fold + its passing selftest. A full standalone JS port is a later beat — the fold logic is what the fixed-point gate covers.
take it →palimpsest measures SURVIVAL, not QUALITY. A line that survived every draft is load-bearing to the author — not thereby correct, good, or necessary. A mistake copied faithfully through every version survives with rate 100% and lands in the core. Persistence is evidence of intent, never of merit. A human reads the core and decides what it means; the tool only makes survival visible and exact.
take it →HAS means exactly one thing: a mark normalizing to this key was DECLARED for this thing — never that the feature works or behaves like the next column's. Parity is a presence fold, not a behavior test; every cell carries predicate 'declared-present', and any row where two or more things HAS a mark is flagged needs-behavior-check. It surfaces where declarations disagree; it does not verify the declarations are true.
take it →quorum counts agreement; it does not judge correctness. N sources can agree and all be wrong — a majority can be a shared blind spot. A quorum means "this many independently landed here", never "here is right". It does not call the models for you — you bring the answers, it folds them. Concordance, not truth.
take it →reading-oath proves COVERAGE — that every shard of your context was seen — not COMPREHENSION; a reader can cover every shard and still misunderstand it. It also trusts the reader to report the ids it actually read: it detects a skipped shard, not a lie about a read one.
take it →this drives a pure state -> frame render loop from an inherited event log, advancing on the event's logical tick t and never a wall-clock; it refuses to exceed its declared per-fold tick budget; it does NOT render pixels, it does NOT persist, it holds NO clock/network/entropy, and it schedules nothing it cannot bound.
take it →running-stats is a one-pass SUMMARY {count,mean,variance,stddev,min,max} — NOT a median/percentile/quantile summary (it keeps no order statistics beyond min and max), and NOT a mode or histogram (see histogram-fold). Its mean/variance are floats: deterministic for a given input order, reorder-agreement within tolerance, NOT an exact multiset fingerprint. Welford's honest guarantee is bounded, non-catastrophic ONE-PASS error — strictly better than the naive sum-of-squares shortcut, NOT a claim to beat a careful two-pass.
take it →seance masks KNOWN secret SHAPES in recovered text. A clean channel means no known shape survived unmasked — never that the recovered text is safe in general, and never that the reason for a deletion is explained. It shows you WHAT a version dropped, not WHY: the reason lives in the commit message and the head that wrote it, not in the bytes. seance is a medium, not an oracle. Two heuristic shapes (JWT, bare 40-hex) are off by default to avoid false masks on ordinary hashes; enable them with --heuristic when the risk warrants.
take it →Extracted verbatim from compile_recipe_spine.py::compile_spine and proven byte-identical to the compiler's inline logic on all 9 spines (roundtrip_selfhost.py 9/9, including the compiler's own Schematic). The served page documents the fold; the byte-truth is the Python fold + its passing selftest. A full standalone JS port is a later beat — the fold logic is what the fixed-point gate covers.
take it →It reports the SIGN, never the VIRTUE: actual >= declared means the count relation holds, not that the work is good — the floor is only as honest as the number you declared. Equality is EXACT with no epsilon (a caller who wants a tolerance band computes it off residual itself; baking one tolerance into the tool would be a policy choice you should own). Only finite numbers count — a missing, non-numeric, NaN, or Infinity field throws with the line number. Malformed input throws, it never repairs.
take it →it is a PRESENCE checker, not a CORRECTNESS oracle: it confirms a scale is declared and self-consistent with the ops used, never that the declared level is the right one, and it does not prove your renderer is a pure fold — that runtime property stays yours to prove.
take it →Commit timestamps BOUND work, they do not MEASURE it — a floor-biased model output (⊢), never a measured truth (⊨). It under-counts on purpose (isolated commit = 0, invisible thinking = 0). NOT a timeclock: do not bill a client to the minute or adjudicate hours with it. The --break-gap assumption is printed in every report.
take it →topk-fold is a one-pass bounded SELECTION {count,k,top} — NOT a full sort of the stream (it keeps only k, in O(k) space), NOT a median/percentile/quantile (it keeps no interior order statistics), and NOT a histogram or a running mean (see histogram-fold / running-stats). k > n returns all n values (not an error). The record is FULLY order-independent (byte-identical for the same multiset in any order) — ties resolved by value, e.g. [5,3,3,3] top-2 = [5,3].
take it →this keeps an append-only, event-sourced undo/redo history bounded by a declared max depth; it reaches any past state by REPLAY from a retained checkpoint, never by mutating stored state in place; it advances on the event's logical tick t and never a wall-clock; it does NOT persist to disk, it holds NO clock/network/entropy, and it refuses to grow history past its declared depth.
take it →You cannot make a cell lie by asserting harder — but Ward checks the witness agrees, not that you chose the right witness. A meaningful witness is still your call.
take it →It reports the commit RECORD, not the work — a day with one big commit and a day with ten trivial ones both read as 'commits'; it doesn't measure effort or lines. Grouping is by committer-date and author-name-as-git-records-it, so skewed clocks (rebases, imports) or one person under two names land in the buckets git gives — it reports what git says, it doesn't reconcile identities or fix clocks. Merge commits are excluded by default.
take it →
It survives store loss, not corruption you push yourself. Push a bad commit and every mirror faithfully keeps your mistake.
take it →conductor runs the commands you give it — it is exactly as safe as the commands in the score, and it does not sandbox them. Its typecheck is the TYPE-level gate (ports line up so data can flow), not a proof the RECORDS fit or that a stage is correct. It proves the run happened in order with a receipt; it never proves the run was right.
take it →gantt-sink is a timeline-bar primitive, not a project-management tool: one <rect> bar per task in INPUT ORDER, each with a <text> label, no axes/dates/dependency-arrows/legend, no fonts/script. Unlike its numbers-only siblings it DOES place caller text — the label — so it carries the one injection surface they avoid; that surface is closed DELIBERATELY: every label is XML-escaped (& < > " '), so a <script> label renders only as escaped entities, never a real tag. Bar colors come from a fixed named palette (index = row), never caller input. A non-finite start/end, an end before its start, or a non-string label is a hard error. Same tasks in → byte-identical SVG out.
take it →grid-sink is a grid-placement primitive, not a layout engine: one <rect> per block at integer (row,col) spanning (w,h) cells, painted from a fixed named palette by index, NUMBERS ONLY (no text-escaping surface), no axes/labels/gridlines/legend, no fonts/script. Its ONE distinguishing decision is the DECLARED OVERFLOW POLICY — a block that exceeds a pinned grid is handled the way the caller declared: error (default, Fit-by-Construction), clip, or skip; never silently. Blocks draw in input order (painter’s order). Bad coord/span, unknown palette, or unknown overflow policy -> hard error. Same blocks + grid + policy in -> byte-identical SVG out.
take it →heatmap-sink is a grid-of-rects heatmap primitive, not a plotting library: one <rect> per (x,y) cell, no axes, labels, legend, colorbar, or title, no fonts/CSS/script. It takes NUMBERS ONLY — (x,y,v) triples — so no caller text reaches the output and there is no escaping surface. Colors come from a fixed named 5-bucket scale (missing cells take a fixed empty fill) — never caller-chosen. Two values in the same band draw the SAME color: it shows the FIELD, not the exact magnitude. A non-finite value, a bad coordinate, or a duplicate (x,y) is a hard error, never a guessed cell. Same cells in → byte-identical SVG out, independent of order.
take it →It persists and moves documents — it does not encrypt them and it does not resolve merge conflicts. A snapshot is plaintext base64: anyone who has the string has the document. And if two devices edit the same catalog entry independently, the last save wins; this layer has no notion of a conflict, only of the most recent write.
take it →Extracted verbatim from compile_recipe_spine.py::compile_spine and proven byte-identical to the compiler's inline logic on all 9 spines (roundtrip_selfhost.py 9/9, including the compiler's own Schematic). The served page documents the fold; the byte-truth is the Python fold + its passing selftest. A full standalone JS port is a later beat — the fold logic is what the fixed-point gate covers. Emits the assembled record canonically; the manifest WRAPPER fields (kind/schema/notes/honest_ceiling/provenance) are schema-constant, carried identically — NOT claimed as fold logic.
take it →ppm-raster is a RASTER PRIMITIVE, not a graphics library: no anti-aliasing, alpha, sub-pixel coordinates, diagonals, curves, text, or color names — colors are integer [r,g,b] 0..255 only. Later primitives paint over earlier ones (painter's order). Out-of-canvas draws clip, never error; a malformed record is a hard error naming the offending line, never a guessed pixel. If you need shapes it doesn't draw, compose upstream — it hands you the clean raster to commit.
take it →sparkline-sink is a GLYPH sparkline, not a chart: one line of 8 discrete block levels, one glyph per value, no axis, labels, numbers, color, or scale markers. Two values in the same eighth of the range draw the SAME glyph — it shows TREND, not magnitude, and it is not a substitute for the number. It takes NUMBERS ONLY (no caller text reaches the output, so there is no escaping surface). A non-finite value is a hard error, never a guessed point. Same series in → byte-identical line out.
take it →svg-sink is a chart PRIMITIVE, not a charting library: geometry only — no axes, gridlines, tick labels, legend, title, or interactivity, and no embedded fonts, CSS, or script. It takes NUMBERS ONLY (no caller text reaches the output, so there is no escaping surface to get wrong); colors come from a fixed named palette, never caller input. A non-finite value is a hard error, never a guessed point. If you need axes or labels, wrap it — it hands you the clean geometry to build on.
take it →
