com.narrowhighway/concordance

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  requests shell access. No manifest field names shell or command execution.

  PERMISSION_SHELL_UNDECLARED

  src/concordance/verifiers/riemann_accel.py, line 85

  subprocess.run(cmd, check=True, capture_output=True, timeout=120)

  tools/build_corpus_cache.py, line 159

  rc = subprocess.call(cmd, env=env)

  tools/check.py, line 28

  return subprocess.call(cmd, cwd=ROOT, env=ENV)

  Show more

  tools/check.py, line 32

  return subprocess.call([sys.executable, "-c", f"import {mod}"], env=ENV,

  tools/checkin.py, line 98

  p = subprocess.run([sys.executable, "-c", _CHILD, json.dumps(job)], capture_output=True, text=True,

  tools/cut_field_pack.py, line 528

  subprocess.run([sys.executable, "-m", "pip", "download", "cryptography",

  tools/export_zim.py, line 52

  r = subprocess.run([sys.executable, str(REPO / "tools" / "export_commons_bundle.py")], env=env,

  tools/gather_founders.py, line 56

  rc = subprocess.run(args, cwd=str(ROOT)).returncode

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach some-llm.example. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  docs/GATEWAY.md, line 28

  const r = await fetch("https://some-llm.example/v1/chat", {

  docs/archive/OPERATIONS_LOG.md, line 524

  Verified on a real fetch (Project Gutenberg): waybill 24,270 bytes + sha256 + status 200, page title

  site/bible.html, line 146

  const r = await fetch(API + path);

  Show more

  site/books.html, line 349

  const r = await fetch('library/index.json', {cache:'no-cache'});

  site/books.html, line 360

  try{ const resp=await fetch('library/'+encodeURIComponent(b.file)); const buf=await resp.arrayBuffer(); startBook(buf, b.title); }

  site/bridge.html, line 304

  return fetch("/bridge.json?t="+Date.now(),{headers:TOKEN?{"X-Keep-Token":TOKEN}:{},cache:"no-store"})

  site/characters.html, line 108

  async function getJSON(p){ const r=await fetch(API+p); if(!r.ok){ if(window.NHGate) await NHGate.isClosed(r); return null; } try{return await r.json();}catch(e){return null;} }

  site/checkit.html, line 174

  fetch("/audit", {method:"POST", headers:{"content-type":"application/json"}, body: JSON.stringify({text:text})})

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  HANDOFF.md, line 91

  - **Droplet:** `[email protected]`, key `~/.ssh/id_ed25519_nh`, path `/home/nh/concordance-2`.

  .gitignore, line 35

  .env

  deploy/README.md, line 38

  Both 2.0 services read `EnvironmentFile=-/home/nh/concordance-2/.env` (chmod 600, gitignored):

  Show more

  deploy/nh-assay.service, line 11

  EnvironmentFile=-/home/nh/concordance-2/.env

  deploy/nh-benchmarks.service, line 12

  EnvironmentFile=-/home/nh/concordance-2/.env

  deploy/nh-com-2.service, line 14

  EnvironmentFile=-/home/nh/concordance-2/.env

  deploy/nh-engine.service, line 15

  EnvironmentFile=-/home/nh/concordance-2/.env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  data/crisis_semantic.json, line 1

  {"_note": "Crisis semantic backstop \u2014 deterministic PPMI over the keeping, JL-projected, int8. Built by tools/build_crisis_semantic.py. Runtime: src/concordance/crisis_semanti

  data/principle_cards.jsonl, line 1

  {"id": "card_spine_principles", "kind": "reference", "title": "The principles of those who won — in their own words", "body": "The stated rules of figures who repeatedly succeeded

  data/semantic_index.json, line 1

  {"_note": "Semantic retrieval index for the live answer-path (docs/THE_WATCH.md step 5). PPMI over the keeping, JL-projected to K dims (int8), plus top-10 meaning-neighbours per wo

  Show more

  data/theory_cards.jsonl, line 1

  {"id": "card_spine_theories", "kind": "reference", "title": "The theories the sciences and math run on", "body": "Every theory the academy stands on, calibrated against what can be

  eval/recurring_form/ot_chiasms.py, line 1

  #!/usr/bin/env python3

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 9a6890d6b5c8. requests shell access. No manifest field names shell or command execution. can reach a host that is not written as a fixed address. can reach some-llm.example. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen