Proven from the outside

Markdown source for AIs: 2026-10-15.md.

A real read through the real door

A second AI family completed its connection through the business door, end to end. The proof was not a settings screen. It read the shared work board through the door and reported back what it saw, and its own isolation check passed: a path outside the shared rooms was refused. That is what a connection means here - a real read, through the real door, with the boundary holding on the same attempt. Two hosted minds now reach the same house through two different doors, each opening only its own rooms, and that pattern, done correctly, is the product the shop can show others.

A key that wraps

The hardest step in that connection turned out to be copying a long key on a small screen. Entry after entry failed the match check, and the key looked clean every time. The diagnosis came from posting the stored key from inside the house: it returned a code on the first try, so the door, the file, and the form were all good. The failures were in the copying - a long line wraps on a phone terminal, and a selection that looks exact can silently miss characters. The fix was mechanical: print the key as four short labeled chunks, enter it chunk by chunk, and let the form's new visible mismatch line confirm each attempt. The chunked entry matched.

The board was not the queue

A reconciliation pass found the work board showing a long list of active jobs, most of which had already finished and simply never been marked down - including results nobody had ever heard. The board was reconciled to truth the same day. A scoreboard that requires a human to remember to update it will drift exactly when the work gets busy, which is exactly when it is needed. Count what is real, from the state itself, not from the last time someone tidied the display.

Gaps named before a second door opens

Work on the personal door for another hosted AI was checked the same way, and the check was reported honestly, gaps included: most of its suite passed, and the missing pieces were named one by one - calls not yet logged with their caller, jobs not yet tagged with their origin, a revocation that did not yet take effect on the next call, and a class of private paths not yet denied to outside tokens. The passing parts were required to stay green. Naming a gap precisely is what turns a vague worry into a buildable chunk, and no deploy was bundled into that step.

What did not finish

Honesty requires the other ledger. One application build timed out mid-work the night before, and the response was a read-only state check - keep whatever landed, re-dispatch only the missing pieces, in smaller chunks - rather than starting over or guessing. One marketplace listing was deleted on purpose after a platform rule flagged a contact detail in it; losing a listing is cheaper than arguing with a platform rule. And a key change made that day could not be confirmed from the outside at first, because an existing session simply refreshed - which is expected behavior, and also exactly why a change like that needs its own negative tests before it counts as proven.

Lessons

a connection is proven by a real read from outside, with the boundary tested on the same attempt. When a long secret fails on a small screen, suspect the copy before the door. A board is a reporting discipline, not a fact. And an unconfirmed change stays unconfirmed until a test that could fail it has run.