← kitporath.com

Evidence index

Every claim I make, mapped to the thing that proves it. Including the claims that can't be proven to you — because an index that quietly omitted those would be marketing wearing an audit's clothes.

Verify these yourself

Commands run against a fresh public clone. I ran every one of them before publishing this page; if any returns something different, that's a finding and I want to know.

Hirdforge is ~67,000 lines of Go across 225 files

git clone https://github.com/sovereignty-labs/hirdforge && cd hirdforge
find . -name '*.go' -not -path './.git/*' | wc -l          # 225
find . -name '*.go' -not -path './.git/*' -exec cat {} + | wc -l   # 67,115

225 files · 67,115 lines

712 merge commits across 1,518 total

git rev-list --merges --count HEAD    # 712
git rev-list --count HEAD             # 1518

712 merges · 1,518 commits

Roughly half the non-merge commits were authored by agents I directed

git shortlog -sn --no-merges HEAD

424 mine, 382 agent personas — 47% of 806 non-merge commits

The personas are warband, ragnar, Knut the Swift, Chuck Norse and others. The history was rewritten to remove infrastructure identifiers, but authorship, author dates and merge topology were preserved deliberately — the history is the evidence, so it was not squashed.

The failure taxonomy exists, and three of the eight errors are mine

open docs/agent-failure-analysis.md in sovereignty-labs/kws

13 claims audited · 8 material errors · 3 of them my own

Open the document →

The power-loss recovery is written up with its defects, not just its outcome

open docs/incidents.md in sovereignty-labs/kws

phase timings, four defects found, and the comparison where the previous platform did better

Open the document →

Decision records keep the rejected alternatives

open docs/decisions.md in sovereignty-labs/kws

ADRs with the alternatives that lost, and why

Open the document →

Attested, but you can't check it

These come from a private estate. The incident records are public and written in detail, but the running systems aren't — so these rest on my word plus a contemporaneous write-up, and you should weigh them accordingly.

Total power loss recovered with zero data loss, no split-brain18 VMs · 6 Kubernetes nodes · 8 GitOps applications · 10/10 storage resources
Chaos test: hard-killed a host running two of three control-plane nodesfailed safe, quorum held, exposed an anti-affinity gap since closed
Supply-chain campaign, 210 → 151 critical CVEsmeasured by scanner, not reported by the agent that did the work
A secrets engine sealed for 27 hours behind green dashboardsfound by querying live state rather than reading the report
19 monitored hosts · ~104 pods · 3-node HA Vault with transit auto-unsealcurrent live estate

I'd rather mark this boundary clearly than let a reader assume everything on the site carries equal weight. Knowing which of your own claims are checkable is the same discipline as knowing which of an agent's claims are.

What I'd push back on if I were you

"Most of the commits weren't typed by a human."

Correct, and the history says so rather than hiding it. The contribution is the architecture, the rejected alternatives, the review, and the verification gates — and every one of those is in the repository as a document you can read. The coverage ratchet exists precisely so an agent can't trade tests for a green build.

"Zero stars. Nobody uses this."

True. These are curated portfolio extracts and a private estate, not products competing for installs. Stars measure adoption of tools; nothing here is asking to be adopted. What's on offer is evidence of operating a platform, and platforms produce uptime rather than stargazers.

"It's a homelab with a nice write-up."

It runs services my family depends on, it survived an unplanned total power loss, and the incident record includes the parts that went badly. Judge it on the failure documentation rather than the hardware — that's the part a lab never has.