The guards

36 automated checks run against this site. Each one names a file, a rule and a finding; each one exits non-zero when the site and its own source of truth disagree. This page is generated from those scripts and from the workflow files that run them, so a guard cannot be added, removed, renamed or quietly unwired without this table following.

Why that matters more than the count. A hand-written list of what CI checks is the artifact a reviewer should trust least: it is a claim about coverage, written by the people whose coverage it describes, with nothing keeping it true. MEASURED 2026-09-24: four of these 36 were referenced by no workflow at all and had never been — they ran only when somebody remembered. They are wired now, and an unwired guard is a red run rather than a footnote.

Controls is how many planted defects a guard is tested against by its own self-test: a fixture is mutated and the run must go red for the named rule. A rule that cannot be made to fail is not a rule. 24 of 36 guards carry a self-test, 140 controls in total, and on 2026-10-04 every one of them passed.

⚠ These numbers are measured, not counted from the source, and the difference is not pedantry. The first version of this page derived them by counting call sites and published 28 against a real 140 — short by exactly one per guard, which is the kind of near-miss that survives review. They now come from guard-controls-2026-10-04.json, which runs every self-test and records what it printed. 3 guard(s) run a self-test that prints no count — check-cost-qualifier, check-design-system, check-tool-names — so their cell says runs, count not printed rather than a number nobody measured.

What this page does not prove

• That the site is correct. A guard proves the site agrees with a source of truth we also wrote. Where that source is the platform itself — a live endpoint, a published package, a registry — the agreement is worth more; where it is a file in this repository, it is worth exactly as much as that file.
• That every claim on the site is guarded. These checks cover what somebody built a check for. A sentence nobody thought to guard is unguarded, and no number on this page would reveal that.
• That a control count is a quality measure. 140 planted defects across 21 guards says those rules have been shown to fail; it does not say the rules are the right rules.
• That the 12 guards with no self-test are weaker. Several of them compare bytes to a LIVE surface, where the surface itself is the control and a planted fixture would prove less.
• That the controls ran in CI on the date above. That capture is one machine on one date. Static guards and their self-tests run in .github/workflows/guards.yml on every pull request and every push to main. Live measurements run in .github/workflows/live.yml once a day at 06:30 UTC, and when somebody dispatches that workflow.
• That a daily run happened. 11 guard(s) share the one schedule in live.yml. check-proof-badges fails on its own if that run stops for eight days. check-host-stamps still fails when a stamp is older than thirty days, and it runs in guards.yml, so a quiet main branch does not exercise it every day.

Related: what is a gate today versus planned, what each proof proves, and the proof runs that re-execute the terminal blocks on /verify/ every day.