This page, a record that checks itself

The brief

Show the work to a stranger without publishing the private record: everything a buyer needs, nothing a stranger should not have, and both halves checkable.

The page also had to be the demonstration. A portfolio that claims craft and cannot show its own engineering is a brochure.

The constraint

One record, many surfaces: this page, the private CV, the terminal at /forge/ and the blocks that go on a platform. A fact typed twice drifts, so every surface derives from the same record.

Anything unmeasured prints as unmeasured, and a page edit invalidates the notary pointer on purpose.

How it is built

Ten hand-written layout families, plus a catalogue that is a function of an address: any six to twelve base36 characters is a design, so a link can be a layout rather than a skin.

A signed notary record names the exact file served. A speed audit reruns every morning and publishes the report for the run it quotes. Four counters count a visit and a request without a cookie. The private CV opens only with a key I issue, and each key carries its own email address, stamped into the CV it opens.

What shipped, and what it cost

A page, a forge, a CV behind a key, an owner view, a request queue and an alias per key that stops working when the key is revoked.

Two defects were found by using it rather than reading it: an owner view that killed the page's own script, and a mail worker that read a field the key store never writes. Both are fixed and both are in the release notes.

What can be checked

The served page's hash is filed in a signed record, so this is the file I measured is a chain and not a sentence.

A revoked key's address answers 550 at SMTP, a live key forwards, and both were proved with real mail on 14 November.

What was decided, and what was not

1. A skin switcher, or a layout engine?

   ChoseTen layout families, plus a derivation

   NotOne template with ten colour palettes

   A palette is a skin. The requirement was that the key changes the layout, so the family, the type and the density have to move with it; the same content reads as a different page, not a recoloured one.

2. A thousand hand-written designs, or a seed?

   ChoseA seed that derives the design

   NotA thousand hand-authored pages

   Hand-writing a thousand is the same page a thousand times, and it ends. A seed turns any short address into a family, a palette, a type and a density, so the catalogue cannot run out and a link stays shareable.

3. One password, or a key per reader?

   ChoseA key per reader, each with its own mail alias

   NotOne shared password

   A shared password cannot be revoked for one person and cannot tell you who opened the CV. A key per reader can be revoked alone, and its alias refuses mail the moment the key dies.

How this was measured

• Lighthouse is the median of three runs on a fixed profile; the report for that exact run is published under its own id.
• The four counters are read from the Worker's own store, not from an analytics vendor.
• The notary record signs the page hash and the record before it, so a change to either is visible.

Receipts

• the proof sectionpage hash, notary record, speed report
• the forgethe same record as a terminal, contact behind a key
• the notary recordsigned, chained to the previous record

What this page does not claim

• The counters start at zero and count four things, not everything.
• A request waits in a queue; no mail is sent when one lands.
• The catalogue is a sampler of layouts, not a claim of a thousand industries.

When it happened

1. 2026-11-14v1.0.0 released, then v1.1.0 with the stranger's path
2. 2026-11-14v1.1.1: an alias cannot outlive its key, found by a real message
3. 2026-11-14v1.2.0: three case studies on their own addresses