habitatinformation governance · walls, barriers, holdouts
Did a readable record shape what the system learned?
Some records must remain readable while being kept out of what a system learns. A walled matter’s files. A bank’s private-side deal data. A revoked-consent record. An evaluation holdout. In every one, the owed claim is identical: this declared set did not condition the derived state — and here is proof.
Value Given a declared exclusion set, the receipt proves the served geometry is byte-identical to the geometry computed as if those records had never been present.
Boundary it does NOT prove the records were never collected, only that the served state is byte-decidably as-if they were absent.
the pain
Today that proof does not exist. It is replaced by procedure. Legal ethical screens are, in the rules’ own words, “reasonably adequate procedures,” and their certifications give “assurance” — an attestation, not a verification; courts often treat imputed conflicts as effectively irrebuttable precisely because non-influence cannot be checked. Finance information barriers concede the point structurally: the regime runs on a rebuttable presumption and burden-shifting because non-use is not directly provable. The AI-governance literature lists “verify that a given dataset was not used” as an open problem. The field’s documented status: unsolved, papered over by procedural attestation.
the exhibit — recompute it yourself
corpus: trace-commons/agent-traces (Hugging Face, CC-BY, 2026-06) · 28 donated coding-agent session traces · declared keep-out set = 7,499 model-generated events, present and readable inside the kit · certified field = the 4,262 eligible events alone · protected geometry: n_tool_use, the count of tool_use blocks, constant on the eligible pool. Register: detection — byte-decidable. Eligible-only reproduces byte-exact; any fold-in of the keep-out set changes the digest. No floor, no null and no ranking is needed to see it.
The keep-out set sits in the kit, readable. The certified geometry recomputes byte-for-byte without it — the state is a pure function of what was allowed in. The declared set left no trace.
That magnitude is set by the ridge, not measured. See the sweep →
This red is a deliberate fold-in we run as a brake test — proof the exclusion is real, not hollow. Had the set entered, GREEN was impossible: the move lands 437 null-widths past the corpus’s own churn null, on the declared axis.
The floor is the record’s own. The null adds 7,499 duplicates of the eligible set’s own rows (10,000 seeded draws, declared alpha 0.01) and asks what re-ingesting the field’s own mass costs at this size. It answers whether anything happened beyond that, never whether it matters.
Edition 2, 20 October 2026. Edition 1 of this kit graded the red against 1e‑06 and printed a ratio to it. That number is the certificate’s bound for a control not being hollow; it never was a floor, and the dose-curve script withdrew it as one. Edition 1 stays beside this one, its fingerprint e2ea26d2…, and every digest is unchanged.
recompute fingerprint — the digit the kit’s verify step reproduces from the eligible set alone, byte-for-byte on any engine that follows the kit’s published canonicalization · sha256 =
67a6f95ee308a2884f73e071ed72bfb0326ba1b7d6da08a147e6ef10394009aa
kit fingerprint · sha256 =
bcde90621f1db3b11e94fdbc1b76bd49a15af1517869512dbd1e50dc85d195d3
The verifier also refuses a
tampered artifact and a partial-exclusion forge — negative controls you run yourself, in a clean
environment (numpy only).
You recompute the geometry, the byte-identical eligible-only baseline, and the declared fold-in yourself — no trust asked. That those vectors are drawn only from the named reference is attested by the certificate; here the reference is public, and it has been checked at the source.
what this does not prove
The receipt proves a substrate-level keep-out: the declared set, though readable, did not condition the certified covariance geometry — and the exclusion is detectable rather than hollow. It does not speak to other substrates — model weights, retrieval indexes, caches, logs. It is a snapshot (“not in this certified state”), not “never at any time”; each certificate re-proves it for its moment. Verification discloses the vectors to the verifier. A human reads the receipt; it is evidence, never a legal verdict — a wall’s legal sufficiency is still for a court to decide.
verify this receipt in your browser
This case's receipt records its verdict and both digests above, and carries its own SHA-256. Recompute it here (WebCrypto, in your tab, nothing sent) and it matches; alter one character of a copy and it fails. It is the smallest version of the whole move: recompute, don't trust. The geometry digest itself you can recompute in this tab, on the method page, or on your bench from the kit.
published fingerprint ·
or download this receipt and check it on your bench:
receipt-keepout-agent-trace.json.
shasum -a 256 prints the same number. Every receipt is on
the ledger.
Edition 2 of this case's kit has its own receipt, receipt-keepout-agent-trace-e2.json (sha256 20b01fe3fdd25debd0445fe53530e3f815be9baf8806742642b7e9c06bf2a456), anchored 2026-10-20; the receipt above is the one the first anchor names.
request the kit
The keep-out receipt kit — artifact, manifest, verify.py. A person sends it: the kit and its
verification steps arrive by reply, usually within a business day.