# SOURCES

Every factual claim on `index.html`, `guide.html`, `system.html` and `notice.html`, mapped to its source. Each claim also carries an HTML comment (`<!-- src: ... -->`) beside it in the page.

Source keys. All paths are in `matt82198/aesop` at `origin/main` sha `0e197fc0497616779c1cebde272854416e578dba` unless noted.

- **README** = the new README from lane L1 (`oss-l1-entry/README.md`), read before it merged, so it is not yet at the sha above. Line numbers are for that file as read. Re-verify them after the L1 PR lands.
- **CHANGELOG** = `CHANGELOG.md`
- **PROVENANCE** = `docs/PROVENANCE.md`
- **INCIDENTS** = `docs/INCIDENTS.md`
- **SECURITY** = `SECURITY.md`
- **CONTRIB** = `CONTRIBUTING.md`
- **CRASH** = `docs/concepts/crash-only.md`
- **STAGE** = `docs/concepts/stage-lanes.md`
- **EVENT** = `docs/concepts/event-store.md`
- **PERPROJ** = `docs/concepts/per-project-stores.md`
- **VERIFY** = `docs/guides/verify-event-store.md`
- **VIS** = `gh repo view matt82198/aesop --json visibility,url` -> `{"url":"https://github.com/matt82198/aesop","visibility":"PUBLIC"}`
- **PKG** = `package.json:3` -> `"version": "0.11.0"`
- **RULING** = a coordinator ruling, not a repo file: R-NOTICE-2 (notice reduced to one sentence), R-LICENSE-1 (license is MIT)

## Visibility, license, contributing

| # | Page | Claim | Source | Line(s) |
|---|---|---|---|---|
| 1 | all | The repository is public at https://github.com/matt82198/aesop | VIS | n/a |
| 2 | all footers | Contributing and security pointers (bug reports, questions, docs fixes and PRs welcome; report vulnerabilities per SECURITY.md) | CONTRIB; SECURITY | CONTRIB 3-5, 11; SECURITY 5-14 |
| 3 | index footer, guide caption, system footer | Open source under the MIT License (LICENSE link) | RULING R-LICENSE-1 | Re-verify against `LICENSE` after PR `chore/license-mit` merges. At sha above, `LICENSE:1` still reads "PolyForm Noncommercial License 1.0.0" |
| 4 | same | Releases 0.8.0 through 0.11.0 were published under PolyForm Noncommercial 1.0.0; versions up to 0.7.0 were MIT | RULING R-LICENSE-1; README | README 129-131 (MIT; 0.8.0 through 0.11.0 PolyForm; up to 0.7.0 MIT) |
| 5 | notice | The dependency advisory is resolved in the current release, 0.11.0 | RULING R-NOTICE-2; CHANGELOG; PKG | CHANGELOG 14 (`[0.11.0] - 2026-10-22`); PKG 3. CHANGELOG does not name the advisory; the "resolved" statement is the ruling |

## index.html

| # | Claim | Source | Line(s) |
|---|---|---|---|
| 10 | A kernel for running fleets of coding agents; an iteration counts only when it leaves a receipt a gate can check | README | 6, 26 |
| 11 | Crash-only: workers stateless, state in git, SQLite and durable files, restart is the recovery path | CRASH | 3-15 |
| 12 | Demo command `npx @matt82198/aesop dash --demo`, no API keys | README | 49-55 |
| 13 | 0.11.0, released 2026-10-22 | CHANGELOG | 14 |
| 14 | 18 PRs merged since v0.10.4 (#1264 to #1284) | CHANGELOG | 16 |
| 15 | 16 rows in the provenance record (rows 4 and 5 share one commit, so rows, not shas) | PROVENANCE | 17-32, 34 |
| 16 | Aesop is a kernel, not a finished autonomous developer; does not know your repos, rules, accounts | README | 24 |
| 17 | What ships: dispatch, gates, receipts, merge, watchdog, durable state, dashboard; skills, brain and CI templates, example config | README | 24, 65-80 |
| 18 | Pre-push policy holds 23 checks, one of them the secret scan that blocks a push | README | 39, 68 (count comment at 39: `grep -cE '^check_[a-z_]+\(\)' hooks/pre-push-policy.sh -> 23`) |
| 19 | What you provide: repos, rules/memory/domain map, optional machinery directory, keys and accounts | README | 81-86 |
| 20 | Loop steps: wave via `driver/wave_loop.py` in a worktree; pre-push checks and receipt step last; `emit_receipt.py` signs; `auto_merge.py` merges green PRs and fixes conflicts | README | 28-29, 34-35, 65, 69-70 |
| 21 | Receipt gate in a measurement period; hosted check not required | README | 20 |
| 22 | Primitives named in the provenance record; private hooks are not shipped | PROVENANCE; README | PROVENANCE 15-32; README 20, 110 |
| 23 | Event store: `prev` is SHA-256 of previous line; tamper-evident, not tamper-proof | EVENT | 3-7 |
| 24 | Receipts signed with Ed25519 or HMAC-SHA256, verified offline; does not prove honest execution | README; PROVENANCE | README 35-37; PROVENANCE 19 |
| 25 | A failed lane is killed, not corrected; contract amended, fresh lane dispatched | CRASH; PROVENANCE | CRASH 22-26; PROVENANCE 29 |
| 26 | Claim binding hook (private, not shipped) | PROVENANCE | 24, 45 |
| 27 | Ledger hooks (private, not shipped) | PROVENANCE | 25-27, 46-47 |
| 28 | Deny-not-rewrite hook (private, not shipped) | PROVENANCE | 21, 40 |
| 29 | Checkpoint-before-compact hook (private, not shipped) | PROVENANCE | 32, 41 |
| 30 | Per-project stores: three read-only views; live cutover not claimed | PERPROJ | 3-6, 94 |
| 31 | Provenance quote | PROVENANCE | 3 |
| 32 | Record and receipt ship in the npm tarball | PROVENANCE | 65 |
| 33 | Verify command; VALID prints `provenance receipt VALID` | PROVENANCE; CHANGELOG | PROVENANCE 53-56; CHANGELOG 32 |
| 34 | VALID does not check commit shas against the repositories | PROVENANCE | 59 |

## guide.html

| # | Claim | Source | Line(s) |
|---|---|---|---|
| 40 | Node.js 18+, Python 3.11+, git; no API keys for the demo | README | 49, 51 |
| 41 | Git and a POSIX shell (Git Bash on Windows) | CONTRIB | 24 |
| 42 | `gh auth login`, Claude Code sign-in, API keys only for an API backend | README | 100 |
| 43 | Scaffold command; `doctor` shows what is missing; skills installed to `~/.claude/skills/` unless `--no-skills` | README | 76, 96 |
| 44 | CLI copies the pre-push policy into the scaffolded repo's hooks | README | 67 |
| 45 | `init --ci-mode`, `watch`, `dash --demo`, `/power`, `/buildsystem` | README | 49-57, 78, 98, 101 |
| 46 | From a checkout: event store unit tests and `verify` | VERIFY | 25, 97 |
| 47 | `project rulings --all-stores` | PERPROJ | 102 |
| 48 | Provenance verify command | PROVENANCE | 56 |
| 49 | Six first-run steps (config, brain, `CONDUCTOR_ROOT`, accounts, one wave) | README | 94-101 |
| 50 | Domain map template; `LANE-CONTRACT.md` is an example | README | 85, 87, 91 |
| 51 | Stage lanes pipeline; one stage per brief | STAGE | 13-21 |
| 52 | Dashboard is a live fleet view with a zero-key demo | README | 74 |
| 53 | Halt switch, self-heal behavior | CRASH | 3-5, 51-62 |
| 54 | `verify` guide; last-line edit passes verify | VERIFY; EVENT | VERIFY 3-4, 22-41, 145-149; EVENT 139-146 |
| 55 | CLI commands and flags restored from help: `--install-deps`, `--force`, `--yes`, `--repos`, `init --ci-mode hosted|self-hosted-runner|local-receipt-gate`, `doctor --json`, `reproduce`, `status`, `fleet`, `wizard` | `node bin/cli.js --help` (aesop checkout, local HEAD 8b0caaae, read-only; origin/main is 94833395) | Usage, Commands and Options blocks; literal help lines are in HTML comments in guide.html |
| 56 | system.html event store card: the v2 store core is hash-chained (each event carries a sha256 prev field) | CHANGELOG | 20 |
| 57 | guide.html: `verify` exits 1 on any problem; verify guide steps 1 to 3 | `tools/event_store/cli.py`; VERIFY | cli.py 100-119 (exit 1 at 119); VERIFY 18, 22-41, 43-92, 94-109 |
| 58 | index.html meta description says MIT License (marked LICENSE-SENTENCE) | RULING R-LICENSE-1 | Re-verify against LICENSE after aesop #1330 merges |

## system.html

| # | Claim | Source | Line(s) |
|---|---|---|---|
| 60 | Figure: orchestrator dispatches the wave; lanes stateless, own worktree, killed not repaired; gates are pre-push checks and secret scan; signed receipt; merge of green PRs; watchdog backs up and scans; durable state in git, SQLite, files | README; CRASH | README 28-29, 65, 68-71; CRASH 11-15, 22-26, 46-49 |
| 61 | Shape: kernel scope and what you supply | README | 24, 81-86 |
| 62 | Durable state: SQLite WAL and git-committed files; restart is recovery | README; CRASH | README 72; CRASH 3-5, 71-75 |
| 63 | Receipts loop steps and caption | README | 6, 20, 26, 28-29, 34-35, 39, 65, 68-70 |
| 64 | Incident ledger: 41 incidents, eight classes, 3 gate-activation, 1 fake-green, all classes inferred from commit subjects | README; INCIDENTS | README 105; INCIDENTS 5, 9-16 (sum of Summary counts 1+21+2+1+4+3+4+5 = 41) |
| 65 | `tests/test_traps.py` reproduces patterns of agent deception | README | 106 |
| 66 | Incident class definitions (fake-green, gate-activation, doc-invented, test-pollution, CI-drift) | INCIDENTS | 12, 14, 11, 16, 9 |
| 67 | Signed receipts: emit last in pre-push, Ed25519 or HMAC-SHA256, `cryptography` optional | README | 34-35, 109 |
| 68 | Verifier recomputes tree hash, exits 0/1/2; proves what ran, not honest execution | README | 36-37 |
| 69 | Provenance receipt signs sha256, path, version; CRLF folded to LF; VALID scope | PROVENANCE | 53, 59 |
| 70 | Event store description, schema 2 vs read-only schema 1 | EVENT | 3-7, 29-33 |
| 71 | `migrate.py` splits a frozen log; migration not claimed run on live data | PERPROJ | 126-128, 139 |
| 72 | Projections; broken-chain store reported and skipped | PERPROJ; CHANGELOG | PERPROJ 94-99; CHANGELOG 27 |
| 73 | Append-only guard; local to worktrees where installed | EVENT | 124-126, 150 |
| 74 | Last line not anchored | EVENT | 143-146 |
| 75 | `state_store/store.py` append-only SQLite in WAL mode | README | 72 |
| 76 | Private hooks (checkpoint-before-compact, handback-ledger, lane-ledger) not shipped | PROVENANCE; README | PROVENANCE 26-27, 32, 41, 46-47; README 20, 110 |
| 77 | Crash-only: quote, stateless workers, contract amended | CRASH | 3-5, 22-26, 38-39 |
| 78 | Watchdog every 150 seconds; halt switch; self-heal; durable state | CRASH | 46-49, 51-54, 56-62, 71-75 |
| 79 | Resume proof runs offline; certificate is dated, not current | CRASH | 79-88 |
| 80 | Does not claim lane stall detection or partial-work recovery | CRASH | 92-97 |
| 81 | Gates: 23 checks; secret scan; pre-push policy copied by CLI; CI-fix catalog | README; STAGE | README 34, 39, 67-68; STAGE 73-74 |
| 82 | Deny-not-rewrite and claim-binding hooks (private, not shipped) | PROVENANCE; README | PROVENANCE 21, 24, 40, 45; README 20 |
| 83 | Stage lanes S1 to S5 table; S5 optional | STAGE | 31-33, 44-48 |
| 84 | Stage order is contract text, not enforced by a checker; dispatch hook not in the repo | STAGE | 97-111 |
| 85 | What ships / what you define / examples | README | 24, 81-92 |
| 86 | Patterns table | README; EVENT; CRASH; PROVENANCE; STAGE | README 26, 28-31, 37; EVENT 3-7; CRASH 22-26; PROVENANCE 40; STAGE 13-17 |
| 87 | Limits list (measurement period, tamper-evident, per-project cutover, dependencies, private parts, cost figures author-reported) | README | 20, 103-111 |

## Blueprint links

| # | Claim | Source | Result |
|---|---|---|---|
| 100 | index.html section #harness-vs-kernel links the docs page docs/quickstart.md | `git ls-tree --name-only origin/main docs/quickstart.md` (aesop origin/main 99b0a351) | path exists |
| 101 | index.html section #receipts links the docs page docs/concepts/receipts-loop.md | `git ls-tree --name-only origin/main docs/concepts/receipts-loop.md` (aesop origin/main 99b0a351) | path exists |
| 102 | index.html section #receipts links the docs page docs/concepts/signed-receipts.md | `git ls-tree --name-only origin/main docs/concepts/signed-receipts.md` (aesop origin/main 99b0a351) | path exists |
| 103 | index.html section #receipts links the docs page docs/guides/verify-receipt.md | `git ls-tree --name-only origin/main docs/guides/verify-receipt.md` (aesop origin/main 99b0a351) | path exists |
| 104 | index.html section #receipts links the docs page docs/reference/receipt-format.md | `git ls-tree --name-only origin/main docs/reference/receipt-format.md` (aesop origin/main 99b0a351) | path exists |
| 105 | index.html section #primitives links the docs page docs/concepts/gates-and-hooks.md | `git ls-tree --name-only origin/main docs/concepts/gates-and-hooks.md` (aesop origin/main 99b0a351) | path exists |
| 106 | index.html section #primitives links the docs page docs/concepts/claim-binding.md | `git ls-tree --name-only origin/main docs/concepts/claim-binding.md` (aesop origin/main 99b0a351) | path exists |
| 107 | index.html section #primitives links the docs page docs/concepts/event-store.md | `git ls-tree --name-only origin/main docs/concepts/event-store.md` (aesop origin/main 99b0a351) | path exists |
| 108 | index.html section #primitives links the docs page docs/concepts/per-project-stores.md | `git ls-tree --name-only origin/main docs/concepts/per-project-stores.md` (aesop origin/main 99b0a351) | path exists |
| 109 | index.html section #provenance links the docs page docs/provenance/README.md | `git ls-tree --name-only origin/main docs/provenance/README.md` (aesop origin/main 99b0a351) | path exists |
| 110 | index.html section #provenance links the docs page SECURITY.md | `git ls-tree --name-only origin/main SECURITY.md` (aesop origin/main 99b0a351) | path exists |
| 111 | index.html section #provenance links the docs page docs/RELEASING.md | `git ls-tree --name-only origin/main docs/RELEASING.md` (aesop origin/main 99b0a351) | path exists |
| 112 | guide.html section #requirements links the docs page docs/quickstart.md | `git ls-tree --name-only origin/main docs/quickstart.md` (aesop origin/main 99b0a351) | path exists |
| 113 | guide.html section #install links the docs page docs/quickstart.md | `git ls-tree --name-only origin/main docs/quickstart.md` (aesop origin/main 99b0a351) | path exists |
| 114 | guide.html section #install links the docs page docs/guides/install-hook.md | `git ls-tree --name-only origin/main docs/guides/install-hook.md` (aesop origin/main 99b0a351) | path exists |
| 115 | guide.html section #commands links the docs page docs/quickstart.md | `git ls-tree --name-only origin/main docs/quickstart.md` (aesop origin/main 99b0a351) | path exists |
| 116 | guide.html section #walkthrough links the docs page docs/quickstart.md | `git ls-tree --name-only origin/main docs/quickstart.md` (aesop origin/main 99b0a351) | path exists |
| 117 | guide.html section #structure links the docs page docs/concepts/stage-lanes.md | `git ls-tree --name-only origin/main docs/concepts/stage-lanes.md` (aesop origin/main 99b0a351) | path exists |
| 118 | guide.html section #structure links the docs page docs/reference/stage-matrix.md | `git ls-tree --name-only origin/main docs/reference/stage-matrix.md` (aesop origin/main 99b0a351) | path exists |
| 119 | guide.html section #watch links the docs page docs/concepts/crash-only.md | `git ls-tree --name-only origin/main docs/concepts/crash-only.md` (aesop origin/main 99b0a351) | path exists |
| 120 | guide.html section #verify links the docs page docs/guides/verify-event-store.md | `git ls-tree --name-only origin/main docs/guides/verify-event-store.md` (aesop origin/main 99b0a351) | path exists |
| 121 | guide.html section #verify links the docs page docs/concepts/event-store.md | `git ls-tree --name-only origin/main docs/concepts/event-store.md` (aesop origin/main 99b0a351) | path exists |
| 122 | system.html section #shape links the docs page docs/quickstart.md | `git ls-tree --name-only origin/main docs/quickstart.md` (aesop origin/main 99b0a351) | path exists |
| 123 | system.html section #receipts-loop links the docs page docs/concepts/receipts-loop.md | `git ls-tree --name-only origin/main docs/concepts/receipts-loop.md` (aesop origin/main 99b0a351) | path exists |
| 124 | system.html section #receipts-loop links the docs page docs/reference/receipt-format.md | `git ls-tree --name-only origin/main docs/reference/receipt-format.md` (aesop origin/main 99b0a351) | path exists |
| 125 | system.html section #signed-receipts links the docs page docs/concepts/signed-receipts.md | `git ls-tree --name-only origin/main docs/concepts/signed-receipts.md` (aesop origin/main 99b0a351) | path exists |
| 126 | system.html section #signed-receipts links the docs page docs/guides/verify-receipt.md | `git ls-tree --name-only origin/main docs/guides/verify-receipt.md` (aesop origin/main 99b0a351) | path exists |
| 127 | system.html section #signed-receipts links the docs page docs/reference/receipt-format.md | `git ls-tree --name-only origin/main docs/reference/receipt-format.md` (aesop origin/main 99b0a351) | path exists |
| 128 | system.html section #event-store links the docs page docs/concepts/event-store.md | `git ls-tree --name-only origin/main docs/concepts/event-store.md` (aesop origin/main 99b0a351) | path exists |
| 129 | system.html section #event-store links the docs page docs/concepts/per-project-stores.md | `git ls-tree --name-only origin/main docs/concepts/per-project-stores.md` (aesop origin/main 99b0a351) | path exists |
| 130 | system.html section #event-store links the docs page docs/guides/verify-event-store.md | `git ls-tree --name-only origin/main docs/guides/verify-event-store.md` (aesop origin/main 99b0a351) | path exists |
| 131 | system.html section #crash-only links the docs page docs/concepts/crash-only.md | `git ls-tree --name-only origin/main docs/concepts/crash-only.md` (aesop origin/main 99b0a351) | path exists |
| 132 | system.html section #gates links the docs page docs/concepts/gates-and-hooks.md | `git ls-tree --name-only origin/main docs/concepts/gates-and-hooks.md` (aesop origin/main 99b0a351) | path exists |
| 133 | system.html section #gates links the docs page docs/concepts/claim-binding.md | `git ls-tree --name-only origin/main docs/concepts/claim-binding.md` (aesop origin/main 99b0a351) | path exists |
| 134 | system.html section #gates links the docs page docs/guides/install-hook.md | `git ls-tree --name-only origin/main docs/guides/install-hook.md` (aesop origin/main 99b0a351) | path exists |
| 135 | system.html section #gates links the docs page docs/reference/gates.md | `git ls-tree --name-only origin/main docs/reference/gates.md` (aesop origin/main 99b0a351) | path exists |
| 136 | system.html section #stage-lanes links the docs page docs/concepts/stage-lanes.md | `git ls-tree --name-only origin/main docs/concepts/stage-lanes.md` (aesop origin/main 99b0a351) | path exists |
| 137 | system.html section #stage-lanes links the docs page docs/reference/stage-matrix.md | `git ls-tree --name-only origin/main docs/reference/stage-matrix.md` (aesop origin/main 99b0a351) | path exists |
| 138 | system.html section #orchestrator links the docs page docs/quickstart.md | `git ls-tree --name-only origin/main docs/quickstart.md` (aesop origin/main 99b0a351) | path exists |
| 139 | system.html section #patterns links the docs page docs/README.md | `git ls-tree --name-only origin/main docs/README.md` (aesop origin/main 99b0a351) | path exists |
| 140 | system.html section #limits links the docs page docs/provenance/README.md | `git ls-tree --name-only origin/main docs/provenance/README.md` (aesop origin/main 99b0a351) | path exists |
| 141 | system.html section #limits links the docs page SECURITY.md | `git ls-tree --name-only origin/main SECURITY.md` (aesop origin/main 99b0a351) | path exists |
| 142 | index.html footer CTAs link docs/README.md and CONTRIBUTING.md | `git ls-tree --name-only origin/main docs/README.md CONTRIBUTING.md` | paths exist |
| 143 | guide.html footer CTAs link docs/README.md and CONTRIBUTING.md | `git ls-tree --name-only origin/main docs/README.md CONTRIBUTING.md` | paths exist |
| 144 | system.html footer CTAs link docs/README.md and CONTRIBUTING.md | `git ls-tree --name-only origin/main docs/README.md CONTRIBUTING.md` | paths exist |
| 145 | notice.html footer CTAs link docs/README.md and CONTRIBUTING.md | `git ls-tree --name-only origin/main docs/README.md CONTRIBUTING.md` | paths exist |
| 146 | index.html hero CTAs link docs/README.md and CONTRIBUTING.md | same ls-tree check | paths exist |

## Removed claims

These appeared on the previous site and are not in the allowed sources or were dropped by the new README, so they were removed: "tamper-proof", fail-closed as a universal invariant, "replaces CI", the 4.3x hierarchical-dispatch cost figure, the wave-11 cancellation, incident #464, multi-model backend and swappable-seat claims, the 39/39 benchmark, the "41 merged PRs and zero receipts" figure, the "harness vs kernel" characterization, the 50-year design lineage, watchdog intervals (10 s heartbeat, 200 s stall, 600 s monitor), the lane-contract rule lists, the dispatch-brief and orchestrator-model descriptions, the CLI flag and command lists not present in the README, and all internal repository and directory names.