{
  "what_this_is": "Every quotation this book marks as `stated`, with the source it was found in. The locator is DISCOVERED, not asserted: each passage is searched for across the estate's published artefacts and the file it is actually found in is what is recorded. `book/build.py` re-reads every one of them out of the source it names on every build; a quote not found where it claims to be fails the build.",
  "normalisation": "HTML tags stripped, entities unescaped, markdown blockquote markers removed, runs of whitespace collapsed to one space — and nothing else. Line wrapping and markup are not differences in the text.",
  "count": 65,
  "unlocated": 0,
  "quotes": [
    {
      "chapter": "01__a-key-means-nothing-alone.md",
      "text": "identity says this key belongs to this agent; a mandate says this agent may do these things, until this date, on whose authority. Both signed, both checkable by a third party, and the mandate revocable independently of the identity — materially different from a bearer token, whose scope is knowable only to its issuer.",
      "source": "llms.txt",
      "verified": true
    },
    {
      "chapter": "01__a-key-means-nothing-alone.md",
      "text": "the mandate is authorisation (somebody decided it); the grant is **authority that nobody decided**. Calling the grant \"implicit authorisation\" concedes the point the vocabulary exists to make.",
      "source": "packs/grant-and-mandate/src/99__change-control.md",
      "verified": true
    },
    {
      "chapter": "01__a-key-means-nothing-alone.md",
      "text": "And under apparent authority the outside world treats the grant as binding anyway — so *the mandate is actual authority, the grant is apparent authority, and binding regardless.*",
      "source": "packs/grant-and-mandate/src/99__change-control.md",
      "verified": true
    },
    {
      "chapter": "02__the-flood-and-the-four-rules.md",
      "text": "A key server may add information to a certificate. It may never delete either a certificate or information about one.",
      "source": "failure/index.html",
      "verified": true
    },
    {
      "chapter": "02__the-flood-and-the-four-rules.md",
      "text": "Append-only is safe when a writer appends only to objects it owns. It is fatal when anyone may append to somebody else's object.",
      "source": "failure/index.html",
      "verified": true
    },
    {
      "chapter": "03__the-bootstrap-trap.md",
      "text": "A signature over an enrolment request proves the submitter controls the corresponding private key. It does not prove that the project should trust the agent. Trust is a policy decision made afterwards.",
      "source": "llms.txt",
      "verified": true
    },
    {
      "chapter": "03__the-bootstrap-trap.md",
      "text": "The agent must already be known in order to ask to be known. **That is the bootstrap trap, restored, at the exact point the pack says it is broken** — and phase 2's acceptance test, a fresh session with a token and nothing else ending with its identity in the register, cannot pass.",
      "source": "packs/registry-mvp/readiness-report.md",
      "verified": true
    },
    {
      "chapter": "03__the-bootstrap-trap.md",
      "text": "**This is answerable today by one experiment against a test lane**, and it is the cheapest de-risking available in the whole pack.",
      "source": "packs/registry-mvp/readiness-report.md",
      "verified": true
    },
    {
      "chapter": "04__grant-is-not-mandate.md",
      "text": "**What the environment can actually do**, as installed and configured. A tree of capability nodes, each carrying what it reaches, the control standing in the way (or nothing), the tier of that control, an evidence class, and a date. Generated by **measurement**, never authored.",
      "source": "packs/grant-and-mandate/src/01__concepts.md",
      "verified": true
    },
    {
      "chapter": "04__grant-is-not-mandate.md",
      "text": "a hand-written grant file is a wish; it records what somebody believed on the day they typed it, which is the thing a grant is not.",
      "source": "packs/grant-and-mandate/src/99__change-control.md",
      "verified": true
    },
    {
      "chapter": "04__grant-is-not-mandate.md",
      "text": "**What the environment is expected to do.** Authored by a person, signed by an **issuer**, naming a **subject**, carrying an **interval** — *without one it is a grant under another name.*",
      "source": "packs/grant-and-mandate/src/01__concepts.md",
      "verified": true
    },
    {
      "chapter": "04__grant-is-not-mandate.md",
      "text": "**Prohibitions shown, allow-list stored and not displayed.** Screen four's trap: an allow-list presented for approval produces consent without comprehension.",
      "source": "packs/grant-and-mandate/src/09__building-blocks.md",
      "verified": true
    },
    {
      "chapter": "05__the-delta.md",
      "text": "**The finding, computed and never stored.** A stored delta is stale the moment either side moves; the interesting property is that it can be recomputed at any time (the same rule that keeps a register entry free of a history array).",
      "source": "packs/grant-and-mandate/src/01__concepts.md",
      "verified": true
    },
    {
      "chapter": "05__the-delta.md",
      "text": "Blast radius measured from the other end, **unaccepted by construction**, defaulting to critical. The security direction.",
      "source": "packs/grant-and-mandate/src/01__concepts.md",
      "verified": true
    },
    {
      "chapter": "05__the-delta.md",
      "text": "The operations direction — the agent fails and it looks like a bug. **It matters as much as excess**, because a mandate the grant cannot satisfy is what produces the next over-broad credential.",
      "source": "packs/grant-and-mandate/src/01__concepts.md",
      "verified": true
    },
    {
      "chapter": "06__boundary-setting-expectation.md",
      "text": "**a control bounds a grant only when it is enforced by something the grant does not include.**",
      "source": "packs/grant-and-mandate/src/01__concepts.md",
      "verified": true
    },
    {
      "chapter": "06__boundary-setting-expectation.md",
      "text": "a control that *evaluates in a separate process outside the agent's loop* is a boundary for the agent even when it is configuration for the platform operator — which is why hooks and Cedar are the natural compilation targets, and why a prompt is not.",
      "source": "packs/grant-and-mandate/src/01__concepts.md",
      "verified": true
    },
    {
      "chapter": "06__boundary-setting-expectation.md",
      "text": "**A tier is a property of a node's relationship to the tree, not of the node. So a tier badge must be able to show what defeats it — and a defeated control must never render as a boundary.**",
      "source": "packs/grant-and-mandate/src/09__building-blocks.md",
      "verified": true
    },
    {
      "chapter": "06__boundary-setting-expectation.md",
      "text": "**The hook is inside the grant it bounds.** The agent runs as a user that can write `.githooks/pre-push`, so by the pack's own test — *a control bounds a grant only when it is enforced by something the grant does not include* — this is a setting that reads like a boundary, which is the exact tier the pack warns is most often mislabelled.",
      "source": "packs/grant-and-mandate/src/07__enforcement.md",
      "verified": true
    },
    {
      "chapter": "07__reality-before-the-risk-register.md",
      "text": "A grant is a *fact*, and a fact is a *measurement*. You cannot author a risk before you have a fact. So the first screen of the MVP is not a risk register and not a risk-appetite questionnaire — it is *which environment, and here is what it can do*. A pack whose first screen is a risk register reproduces exactly the habit it exists to fix.",
      "source": "packs/grant-and-mandate/src/00__LEADING-BRIEF.md",
      "verified": true
    },
    {
      "chapter": "07__reality-before-the-risk-register.md",
      "text": "This is the clearest case in the whole product, because it needs no security argument — anybody understands that a tool which remembers everything you have shown it can be asked about any of it, and the asking need not come from you.",
      "source": "packs/grant-and-mandate/src/00__LEADING-BRIEF.md",
      "verified": true
    },
    {
      "chapter": "08__the-register.md",
      "text": "ONE RECORD IS REAL (private_key_published: false) — which is what makes the flag evidence rather than a column.",
      "source": "registry/llms.txt",
      "verified": true
    },
    {
      "chapter": "08__the-register.md",
      "text": "What a verified signature proves here: that the statement was signed by a holder of that private key. What that is worth on a FIXTURE record: nothing — you are also a holder of that private key.",
      "source": "registry/llms.txt",
      "verified": true
    },
    {
      "chapter": "08__the-register.md",
      "text": "If your verifier reproduces all six (as of the file's as_of date), it implements this register's walk. If it passes any of them WITHOUT surfacing the fixture caveat, it skipped the flag rule and is wrong while looking right.",
      "source": "registry/llms.txt",
      "verified": true
    },
    {
      "chapter": "08__the-register.md",
      "text": "A role is a costume, not an identity. The register can say what the role may do — role-site-agent holds an accepted mandate for repo.pull-request.create on this repository, constrained to registry/** on dev — and can never say who wore it.",
      "source": "registry/llms.txt",
      "verified": true
    },
    {
      "chapter": "09__a-grant-is-discovered.md",
      "text": "a direct self-measurement probe (reading the harness's own settings and hooks, testing non-allowlisted egress hosts, checking privilege escalation) was REFUSED by an account-level policy classifier that evaluates outside the agent's loop. The refused nodes below are marked unevidenced rather than guessed. The refusal is itself the sharpest datum in this entry: a boundary-tier control, observed working, on the measuring agent itself.",
      "source": "packs/grant-and-mandate/library/claude-code-remote__ccr-container__2026-08-26.json",
      "verified": true
    },
    {
      "chapter": "09__a-grant-is-discovered.md",
      "text": "root in the container → egress through the proxy → a push credential whose branch discipline is prose. The push to the release branch deployed a public site: the only containment on that step was the session doing what it was told — and in this session, explicit permission was in fact given first, which is the mandate working as an expectation, not as a mechanism.",
      "source": "packs/grant-and-mandate/library/claude-code-remote__ccr-container__2026-08-26.json",
      "verified": true
    },
    {
      "chapter": "10__a-push-refused.md",
      "text": "Run the skill in a fresh environment. It produces a dated grant document nobody wrote. Author a mandate that is deliberately narrower. The delta is non-empty and specific. Compile one line of it into the existing hook. **Then attempt the prohibited action and be refused by something that is not the agent.**",
      "source": "packs/grant-and-mandate/src/07__enforcement.md",
      "verified": true
    },
    {
      "chapter": "10__a-push-refused.md",
      "text": "That sequence — *issue → refuse → discover the mandate was wrong → amend, with a citation and an interval* — is what a mandate is **for**, and it is only visible because the constraint was mechanical. An expectation that was too narrow would have been silently ignored and nobody would have learned anything. **The refusal is what forced the authorisation to be written down.**",
      "source": "packs/grant-and-mandate/src/07__enforcement.md",
      "verified": true
    },
    {
      "chapter": "10__a-push-refused.md",
      "text": "*a hook enforcing a fixture-signed mandate is real enforcement of an unaccountable instruction.*",
      "source": "packs/grant-and-mandate/src/07__enforcement.md",
      "verified": true
    },
    {
      "chapter": "11__the-building-blocks.md",
      "text": "if a block needs data no schema carries, the block is wrong, not the schema.",
      "source": "packs/grant-and-mandate/src/09__building-blocks.md",
      "verified": true
    },
    {
      "chapter": "11__the-building-blocks.md",
      "text": "see interpretation.finding_1 — this tier label is WRONG, and node n1a is the proof",
      "source": "packs/grant-and-mandate/library/github-actions-runner__ci__2026-08-26.json",
      "verified": true
    },
    {
      "chapter": "11__the-building-blocks.md",
      "text": "A single combined status would have to average them, and averaging them is exactly how a demonstration gets mistaken for a control.",
      "source": "packs/grant-and-mandate/src/09__building-blocks.md",
      "verified": true
    },
    {
      "chapter": "12__the-library-and-the-instance.md",
      "text": "the registry holds the library (public, no personal data ever); the risk product holds the instance (all personal data, never published); and **the instance stores references, never copies.**",
      "source": "packs/grant-and-mandate/src/99__change-control.md",
      "verified": true
    },
    {
      "chapter": "12__the-library-and-the-instance.md",
      "text": "**Settled — RiskMandate CONSUMES it. The library/instance split argued for it and the project lead confirmed: two products, one component contract**",
      "source": "packs/grant-and-mandate/src/99__change-control.md",
      "verified": true
    },
    {
      "chapter": "13__two-paths.md",
      "text": "the library must be obtainable in **one fetch**; the agent's output is a **document, not a rendering** (if the interface is where the data lives, the agent path does not exist); and the self-report must be **structured before it is compared**, which is what makes the blind-spot delta computable rather than a judgement.",
      "source": "packs/grant-and-mandate/src/00__LEADING-BRIEF.md",
      "verified": true
    },
    {
      "chapter": "15__where-this-estate-disagrees-with-itself.md",
      "text": "base64 of RAW r||s (64 bytes), ECDSA P-256 over SHA-256 — sgit's format, chosen for Web Crypto interop: a browser can verify these statements with no conversion",
      "source": "registry/llms.txt",
      "verified": true
    },
    {
      "chapter": "15__where-this-estate-disagrees-with-itself.md",
      "text": "`\"\"\"Recomputed here from the two documents, never stored.\"\"\"`",
      "source": "admin/build/gen_blocks.py",
      "verified": true
    },
    {
      "chapter": "15__where-this-estate-disagrees-with-itself.md",
      "text": "Eight documents plus a change-control appendix now running to **sixteen corrections and twenty-nine decisions**.",
      "source": "packs/grant-and-mandate/src/08__build-record.md",
      "verified": true
    },
    {
      "chapter": "15__where-this-estate-disagrees-with-itself.md",
      "text": "**The appendix now runs to twenty-three corrections and thirty-six decisions, and roughly a third of the decisions are open.**",
      "source": "packs/registry-mvp/registry-mvp-briefing-pack.zip!pack/README.md",
      "verified": true
    },
    {
      "chapter": "15__where-this-estate-disagrees-with-itself.md",
      "text": "**Regenerating the zip on release is a build step, not a decision**, and until it is one the artefact designed to onboard fresh sessions is the least current thing in the pack.",
      "source": "packs/registry-mvp/readiness-report.md",
      "verified": true
    },
    {
      "chapter": "15__where-this-estate-disagrees-with-itself.md",
      "text": "**The REP still points a fresh implementer at the superseded form**, and the cheapest fix remains one sentence at §2 saying which half is current.",
      "source": "packs/registry-mvp/src/99__change-control.md",
      "verified": true
    },
    {
      "chapter": "15__where-this-estate-disagrees-with-itself.md",
      "text": "Decision 6 reads *First capability (`repo.pull-request.create`) — open, awaiting project lead*, which frames the gap as *which one do we do first*. Section 4's Q3 argues the gap is *what is a capability name*, and that it sits under excess authority, not only under the shortfall the pack already flags.",
      "source": "packs/registry-mvp/readiness-report.md",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That anything here is trustworthy. Ten of the eleven records are fixtures — private keys published on purpose — so every signature verifies and proves nothing",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the root can be relied on: it is a fixture root, and roots.json says so in its own entry",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That enrolment works without a human: the write path is a git commit reviewed by a maintainer, not the account-less lane the pack designs",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the mandate has any authority. Its issuer is the fixture root, so anybody could forge it and the hook would enforce the forgery just as diligently",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the constraint is a boundary: it reached tier setting, and --no-verify still gets past it",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That it protects a fresh clone — the hook file is committed, the config that activates it is local and does not travel",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the measurement is complete. An agent measuring its own grant reports what it can see; it is a floor, not a census, and says so on its face",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "Anything about environments nobody has measured — two entries, one agent, and a blind-spot delta needs at least two agents against a common reference",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That a hand-assembled entry is as good as a measured one: the gallery caught schema drift in the hand-written entry and none in the tool-generated one",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the components survive contact with a population. They have been exercised against two environments and one mandate, all measured by one agent",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the layouts hold on a phone — the grant tree below 390px has a proposed degradation nobody has tested",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That a second consumer will find the contract workable; RiskMandate is committed to consuming it and has not yet",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the library covers anybody's real estate. Scenario 5 has no tree to point at at all",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the assessment changes what anybody does — it has no backend, so it can measure none of its own success measures",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the acceptor model is sound: it offers a role where the pack's own standard asks for a named person",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That synthetic readers can report preferences. They find defects; a preference from a simulated reader is not evidence and the programme says so",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the findings generalise — one run, one archetype, one page",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the simulation marker survives export, which is the rule most likely to be broken by accident",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the estate it describes is trustworthy. The book's own centre of gravity is a register whose ten fixture records prove nothing and whose root is a fixture — a reader who finishes believing otherwise has read a book that failed",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That a participant's account can be neutral. The mitigations are real and are not independence: the strongest bias in such an account is not what it says but what it thinks to check, and there is no way for the writer to know what it did not think to run",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That the estate is mature enough to deserve a book — two environments, one agent, one mandate, a fixture root, and one outside reader in its entire history, whose single pass produced half the open contradictions in chapter 15",
      "source": "bench/llms.txt",
      "verified": true
    },
    {
      "chapter": "16__what-ships-what-is-argued.md",
      "text": "That any of this is needed. Nobody outside the project has been asked, which the estate's own doctrine appendix rates a Phase I hole rather than a nice-to-have",
      "source": "bench/llms.txt",
      "verified": true
    }
  ]
}