The guards

28 automated checks run against this site. Each one names a file, a rule and a finding; each one exits non-zero when the site and its own source of truth disagree. This page is generated from those scripts and from the workflow files that run them, so a guard cannot be added, removed, renamed or quietly unwired without this table following.

Why that matters more than the count. A hand-written list of what CI checks is the artifact a reviewer should trust least: it is a claim about coverage, written by the people whose coverage it describes, with nothing keeping it true. MEASURED 2026-09-24: four of these 28 were referenced by no workflow at all and had never been — they ran only when somebody remembered. They are wired now, and an unwired guard is a red run rather than a footnote.

Controls is how many planted defects a guard is tested against by its own self-test: a fixture is mutated and the run must go red for the named rule. A rule that cannot be made to fail is not a rule. 15 of 28 guards carry a self-test, 87 controls in total, and on 2026-09-24 every one of them passed.

⚠ These numbers are measured, not counted from the source, and the difference is not pedantry. The first version of this page derived them by counting call sites and published 28 against a real 87 — short by exactly one per guard, which is the kind of near-miss that survives review. They now come from guard-controls-2026-09-24.json, which runs every self-test and records what it printed. 3 guard(s) run a self-test that prints no count — check-cost-qualifier, check-design-system, check-tool-names — so their cell says runs, count not printed rather than a number nobody measured.

What this page does not prove

• That the site is correct. A guard proves the site agrees with a source of truth we also wrote. Where that source is the platform itself — a live endpoint, a published package, a registry — the agreement is worth more; where it is a file in this repository, it is worth exactly as much as that file.
• That every claim on the site is guarded. These checks cover what somebody built a check for. A sentence nobody thought to guard is unguarded, and no number on this page would reveal that.
• That a control count is a quality measure. 87 planted defects across 12 guards says those rules have been shown to fail; it does not say the rules are the right rules.
• That the 13 guards with no self-test are weaker. Several of them compare bytes to a LIVE surface, where the surface itself is the control and a planted fixture would prove less.
• That the controls ran in CI on the date above. That capture is one machine on one date. CI runs the same self-tests on every push, and that is what makes the numbers load-bearing rather than decorative.
• That a daily run happened. 8 guard(s) are on a schedule, and a schedule is a promise about intent. Two of them fail on their own if the run stops — check-proof-badges after eight days, check-host-stamps after thirty — which is the only reason a stopped schedule becomes visible.

Related: what is a gate today versus planned, what each proof proves, and the proof runs that re-execute the terminal blocks on /verify/ every day.