What is not yet true¶
This page exists so that nobody has to discover these by reading the source. It sits at the top level of the navigation deliberately: a reader who finds it late has been misled by everything before it.
As at 5 August 2026.
No Merkle root has been published¶
Tamper-evidence is a capability, not a property. The kernel computes daily roots and can prove a record's membership in one — but the only party attesting to that root is the kernel itself, and a system that keeps its own root, shows you that root, and confirms your record is in it has told you nothing it could not have made up.
GET /v1/anchors/roots returns nothing for every date. No publisher is
configured, and no testnet topic has been created.
Do not describe this system as tamper-evident. See Anchoring.
Erasure is unimplemented¶
There is no way for a data subject to have a record erased. Append-only makes this a design question rather than a missing endpoint: an erased record's leaf hash would already be published, so the salt must be deleted as part of erasure, and what remains must still be provably a valid tree.
Open decision D3, with counsel.
Every conversion factor is assumed or synthesised¶
Not one has been measured. Every normalized_kg in the system rests on a factor
whose basis is assumed_default or on a synthesised seed row.
The provenance is honest — kernel_assumed_conversion_share publishes the
share, and it is effectively 1 — but a lender reading a derived mass is reading
an assumption, correctly labelled. See The quantity problem.
No PDPO registration¶
s.29 requires registration with the Personal Data Protection Office. It has not been done. Processing real personal data before it is done would be unlawful.
No penetration test¶
None has been commissioned or performed. The specific untested boundary that
matters most: verifiedSubject() trusts a header set by the gateway. If that
header can be set by a caller, every consent control in the kernel is
bypassed. The kernel cannot defend this by itself.
Ten open decisions¶
Four need cooperative field work; five need counsel. They are recorded in the decisions index rather than resolved by assumption. The live ones a reader should know about:
- D3 — erasure, above
- D7 — whether delegation scope is per record type or per field
- s.9(3)(c) — whether a cooperative may rely on member-body processing for
special data, and the
S9_CONSENT_REQUIRED_FOR_MEMBER_BODYguard that depends on the answer
FAO-derived yields are barred from commercial promotional use¶
The licence prohibits it. The demo profile exists so that promotional material
can be produced without them. See Data sources.
Also true, and worth stating¶
No real record has ever been stored. Every record that has existed in this system was synthesised — by tests, by the seed, or by the dry run.
Two constraints are NOT VALID. facts_lawful_basis_stated and
inference_lawful_basis_stated bind new rows and have never been verified
against existing ones. See Migrations.
s.16(4) notifications accumulate with no channel to discharge them. The obligation is counted; nothing can currently act on the count.
There is no operator tooling to read the audit log. s.37 asks for production on demand, and refusal reasons now go there, so this matters more than it did.
Objection scope is a record type, and a farmer reasons in purposes. Lodging
the objection she means returns stopped_nothing_out_of_scope — accurate, and it
stops nothing. Reported as a finding, not patched, because it is a decision.
No timed restore drill. Recovery objectives in Runbook §2 are stated targets, not measured ones.
Abandoned upload_session rows never expire. Nothing reaps them.
The region limb of the scope check is unreachable. Dead code paths in a consent check are the ones you least want unexercised.
No test asserts the MinIO bucket's anonymous policy is none. ADR 0040
requires it; nothing checks it.
Runbook §1 contact rows are empty. A breach procedure with nobody to call is a document, not a procedure.