habitatinformation governance · walls, barriers, holdouts
Did a readable record shape what the system learned?
Some records must remain readable while being kept out of what a system learns. A walled matter’s files. A bank’s private-side deal data. A revoked-consent record. An evaluation holdout. In every one, the owed claim is identical: this declared set did not condition the derived state — and here is proof.
Value Given a declared exclusion set, the receipt proves the served geometry is byte-identical to the geometry computed as if those records had never been present.
Boundary it does NOT prove the records were never collected, only that the served state is byte-decidably as-if they were absent.
the pain
Today that proof does not exist. It is replaced by procedure. Legal ethical screens are, in the rules’ own words, “reasonably adequate procedures,” and their certifications give “assurance” — an attestation, not a verification; courts often treat imputed conflicts as effectively irrebuttable precisely because non-influence cannot be checked. Finance information barriers concede the point structurally: the regime runs on a rebuttable presumption and burden-shifting because non-use is not directly provable. The AI-governance literature lists “verify that a given dataset was not used” as an open problem. The field’s documented status: unsolved, papered over by procedural attestation.
the exhibit — recompute it yourself
corpus: trace-commons/agent-traces (Hugging Face, CC-BY, 2026-06) · 28 donated coding-agent session traces · declared keep-out set = 7,499 model-generated events, present and readable inside the kit · certified field = the 4,262 eligible events alone · protected geometry: n_tool_use, the count of tool_use blocks, constant on the eligible pool. Register: detection — byte-decidable. Eligible-only reproduces byte-exact; any fold-in of the keep-out set changes the digest. No floor, no null and no ranking is needed to see it.
The keep-out set sits in the kit, readable. The certified geometry recomputes byte-for-byte without it — the state is a pure function of what was allowed in. The declared set left no trace.
That magnitude is set by the ridge, not measured. See the sweep →
This red is a deliberate fold-in we run as a brake test — proof the exclusion is real, not hollow. Had the set entered, GREEN was impossible: the move lands ~9×10⁷× past the declared floor, on the declared axis.
A noise floor, not a materiality threshold. Below 1e‑06 a digest difference is floating‑point, not movement. It answers whether anything happened, never whether it matters — and nothing published here has come near it.
recompute fingerprint — the digit the kit’s verify step reproduces from the eligible set alone, byte-for-byte on any engine that follows the kit’s published canonicalization · sha256 =
67a6f95ee308a2884f73e071ed72bfb0326ba1b7d6da08a147e6ef10394009aa
kit fingerprint · sha256 =
e2ea26d2290b536158493635ae6c4958072e4ce56e7c1f36c7b2d2332c51c37a
The verifier also refuses a
tampered artifact and a partial-exclusion forge — negative controls you run yourself, in a clean
environment (numpy only).
You recompute the geometry, the byte-identical eligible-only baseline, and the declared fold-in yourself — no trust asked. That those vectors are drawn only from the named reference is attested by the certificate; here the reference is public, and it has been checked at the source.
what this does not prove
The receipt proves a substrate-level keep-out: the declared set, though readable, did not condition the certified covariance geometry — and the exclusion is detectable rather than hollow. It does not speak to other substrates — model weights, retrieval indexes, caches, logs. It is a snapshot (“not in this certified state”), not “never at any time”; each certificate re-proves it for its moment. Verification discloses the vectors to the verifier. A human reads the receipt; it is evidence, never a legal verdict — a wall’s legal sufficiency is still for a court to decide.
verify this receipt in your browser
This case's receipt records its verdict and both digests above, and carries its own SHA-256. Recompute it here (WebCrypto, in your tab, nothing sent) and it matches; alter one character of a copy and it fails. It is the smallest version of the whole move: recompute, don't trust. The geometry digest itself you can recompute in this tab, on the method page, or on your bench from the kit.
published fingerprint ·
or download this receipt and check it on your bench:
receipt-keepout-agent-trace.json.
shasum -a 256 prints the same number. Every receipt is on
the ledger.
request the kit
The keep-out receipt kit — artifact, manifest, verify.py. A person sends it: the kit and its
verification steps arrive by reply, usually within a business day.