# Resume — state at 2026-08-05, after the final deploy

**HEAD pushed AND deployed. 2,353 passed, 1 xfailed. `make fresh-check` passes on a clone in 307s,
exit zero — re-run 2026-08-08 at commit `ba5965b`.**
Repo public: https://github.com/jsahasi/verbatim · Live: https://verbatim.citelocal.ai
`/healthz` returns `{"status":"ok","corpus_loaded":true,...,"changes":171}`.

Deadline is TODAY. Submission + 60-minute DeepInterview as one sitting.

## Score against "How we evaluate": 97/100

| Criterion | Wt | Score | Note |
|---|--:|--:|---|
| Working prototype ("the main event") | 30 | 29 | live at HEAD; `make fresh-check` green; `make reset-demo`; last clock-dependent flake gone |
| Four required capabilities | 25 | 24 | change→obligation join now routes honestly (ADR-87) |
| Depth area | 10 | 10 | citation grounding; the gate refuses the model's own verdict |
| PRD | 10 | 9.5 | trust metrics + expansion both substantial |
| TDD | 10 | 9.5 | build-method section + fan-out diagram |
| Not a thin wrapper | 10 | 10 | the deterministic half runs with no key |
| Submission mechanics | 5 | 5 | public, unsquashed, template filled |

The earlier file said 91 in its header while its own table summed to 95 — I revised
two rows and did not revise the total. The table was right both times.

## What the last commit changed
1. **`ROUTE_MAPPING_UNCONFIRMED`, the sixteenth refusal code (ADR-87).**
   `resolve_change_owner` never read `mapped_by_kind`, so a mapping the pipeline
   guessed from a word overlap assigned work to a named person exactly as a
   person-confirmed one did. The would-be owner now goes in `candidate_user_ids`,
   never `user_id` — and since the new code is not in `ROUTE_OK_CODES`, the
   existing invariant does the enforcing. `ROUTE_PENDING_ACCEPTANCE` converts too,
   which cost nine `test_invites` failures that were fixed, not exempted.
2. **The materiality verdict is stored and audited** under `ACTION_MATERIALITY_SET`
   (ADR-86). The model was re-judging on every render. The citation is still
   re-verified on every read, so this is not the cached verdict ADR-003 refuses.
3. **Thirty-two clocks pinned, strict xfail deleted.** Tests asserting a default
   (a fresh session is live) are named in `ALLOWED` with the reason rather than
   pinned. One of these fired at 09:00 yesterday; the next would have shown a
   reviewer a red suite.

## Read before the interview
`docs/.ai/briefing.html` — a ten-minute read. Five-file map, nine-step walkthrough
of `/changes/{id}`, verified numbers, uncomfortable questions, three stories.

**Five files decide everything:** `verifier.py::verify_citation` (151) ·
`claims.py::verified_claims` (502) · `queries.py::_require_scope` (60) /
`row_for_company` (113) · `audit.py::record_event` (515) / `verify_chain` (668) ·
`diff/engine.py::diff` (78). The two smallest matter most.

## Numbers that survive checking
2,353 tests · 90 ADRs · 82 modules · 135 commits · `make eval` 5 of 5 ·
retrieval 0.5–1.1ms vs 357–364ms on 8,707 passages · Kentucky pair 1,024,409 vs
1,024,536 chars, 127 apart, 144 changes · 102 filings, 8 commissions, 19 dockets ·
26 change→obligation mappings (24 proposed, 2 confirmed) · 16 refusal codes.

**DO NOT SAY:** "101 of 176 vs the old suites' 2" — the 2 was test *files*. True
version: an 18-deletion audit where hand-written files caught 4; a separate
176-deletion campaign where the derived rule caught 78 per-function, 101 per-query.
No mutation harness was committed, so nothing reproduces these.

**Glass contrast is 16.41:1 → 16.73:1**, not 15.84 → 16.15. I measured the first
pair against an ink colour not in the stylesheet.

## Open, ranked — all of these are known and none is on the demo path
1. **`restore()` in `backup.py` says "Nothing was written" and can leave a partial
   file.** A refusal that is not true is worse than no refusal. Highest-value
   remaining fix and the one I would name first if asked what is broken.
2. **Confirming a mapping is a database write with no screen.** ADR-87 converts a
   wrong answer into a dead end until that screen exists. Named as a cost there.
3. **Nothing forces `mapped_by_kind` to be set at write time**, so ADR-87's refusal
   is only as good as the column.
4. **No test asserts every one of the 16 refusal codes has words a person can read.**
5. **`AnthropicTransport` is unexercised** — every test drives a deterministic fake.

## Deploy (already done; here for the next time)
```
make publish-docs
# --filter=':- .gitignore' IS LOAD-BEARING, and it was missing until 2026-08-11.
# rsync does not read .gitignore. Without that filter this command copies every
# ignored file, and docs/first-90-day-plan.html -- git-ignored on purpose, named
# in scripts/publish_docs.py's NOT_PUBLISHED, carrying commercial positions
# written for one reader -- was found sitting in /data/strata/src/docs/ on the
# server. It was never web-reachable (404 on both routes, and it is not in the
# published site directory), so nothing leaked. It should not have been there.
# --exclude .claude keeps the agent worktrees out; they are whole clones.
rsync -a --delete -e "ssh -i ~/.ssh/citelocal_deploy" ./ root@143.198.140.28:/data/strata/src/ \
  --filter=':- .gitignore' \
  --exclude .git --exclude .venv --exclude __pycache__ --exclude verbatim.db \
  --exclude .env --exclude .claude
ssh -i ~/.ssh/citelocal_deploy root@143.198.140.28 'cd /data/strata/src && docker compose build verbatim-app && docker compose up -d'

# nginx.conf IS NOT DEPLOYED BY THE RSYNC ABOVE, and this step was missing from
# these notes until 2026-08-08. The site container mounts /data/strata/nginx.conf,
# NOT the copy inside /data/strata/src/deploy/. Sync the source, rebuild, and the
# proxy list on the box is still yesterday's -- so a newly mounted route 404s in
# production while every test passes. That is the P0-5 failure one level up, at
# the deploy rather than in the file. Only needed when deploy/nginx.conf changed.
ssh -i ~/.ssh/citelocal_deploy root@143.198.140.28 \
  'cp /data/strata/src/deploy/nginx.conf /data/strata/nginx.conf \
   && cd /data/strata/src \
   && docker compose exec -T verbatim-site nginx -t \
   && docker compose exec -T verbatim-site nginx -s reload'
rsync -a --delete -e "ssh -i ~/.ssh/citelocal_deploy" deploy/site/ root@143.198.140.28:/data/strata/site/
```
Key: `~/.ssh/citelocal_deploy`. Nothing else authenticates. `/healthz` 502s during
seed on a cold boot — wait for it, it is not a failure.