The Refusal Engine
A machine whose whole job is to say no, and show its work.
The ingredients 7 gifts
The idea
A chunk of these gifts are refusal engines — their reason to exist is to refuse. conflict won't let a broken merge land. loop21-verifyskin won't let an injection through. switchboard structurally cannot carry a command. dwell won't let you pick an option until you actually commit. Bolt them together and you get a gate a person or an agent has to pass through — one that refuses bad moves and names which rule stopped you and why.
The parts + how they wire
An untrusted request comes in → conflict + loop21-verifyskin + isvalidcsscolor form the refusal wall (each a filter rejecting its own class of bad input) → survivors cross switchboard (the relay that carries evidence but not commands) → a genuinely-deferred decision routes through dwell → every hop lands in tracebus's append-only ledger → ward renders the final badge, which only goes solid when every witness agrees. Nothing is approved on hope.
The one piece you build
The policy layer — the thing that decides which refusals apply to which request. The gifts supply the refusals; you supply the rulebook that routes a request to them and composes the verdict.
The technical breakdown
switchboard's no-command guarantee is the schema, not a convention: the message schema has a closed set of exactly six top-level fields and the validator rejects any unknown top-level key; there are four kind values (status, focus, fyi, question) and deliberately no imperative one — so action/command/run aren't blocked by a filter, they're unrepresentable. Your policy layer treats a switchboard message as evidence, full stop. ward's 'won't go solid on hope' is literal: every badge cell carries a witness beneath it or stays a hollow ring — so your layer defines, per request class, which cells must be witnessed before the badge renders green (a config table plus one call to ward). conflict catches the standard git-marker triad; your rulebook decides what a positive means for a given request. Call it ~150 lines: a request-class table, a dispatch loop, and a composer that turns the witness set into a ward badge.
The honest edge
Every gift here is visibility, not immunity. ward checks that the witness agrees, not that you picked the right witness. conflict catches the standard marker triad, not a custom conflict format. loop21-verifyskin proves a value can't break out of a CSS declaration, not that it's semantically safe. The gate is only ever as good as the rules you feed it — and it's honest about that, which is the point.
These are ingredients, not instructions you have to follow. If you cook something from them — or something stranger — we want to see it.